Container Registry and Software Supply Chain Platform  ·  View 30 of 33  ·  6 · Assurance

Key Management and Trust Roots

Which keys exist, who holds them, and what rotation does to signatures already made.

Editable source SVG draw.io All views
Offline root — ceremony, air-gapped, two-person TUF root root.json 5-of-9 threshold Root Key Shares HSM smartcards Superseded Roots verifiable 7 y Online signing — the keyless path CA and logs Fulcio Intermediate Vault PKI · 90 d Rekor Signing Key CT Log Key Long-lived — air-gap and release path HSM held Air-Gap Release Key never exported Policy Bundle Key Base Image Key Distribution and rotation To every verifier TUF Metadata timestamp 1 d In-Cluster Trust Bundle ≤ 30 d offline Rotation Runbook no re-signing needed HSM Appliance PKCS#11 · logged per op Root Ceremony Quorum grant ≠ use delegates signs targets polled PKCS#11 resident still verifiable Key Management and Trust Roots Security / platform Data store Application we own Person or role synchronous event / async Rotation never invalidates signatures made under the previous root. No single identity may both grant signing authority and use it. v 1.0 · owner Security Architecture · date 2026-09

Decisions

  • TUF root with a 5-of-9 threshold, held on HSM smartcards, exercised in an air-gapped ceremony
  • Online signing uses a Fulcio intermediate whose key lives in Vault backed by the HSM, rotated every 90 days
  • Long-lived keys exist only for the air-gapped release path, base-image releases and policy bundle signing

Rotation

  • Trust-root rotation does not invalidate signatures produced under the previous root
  • Superseded roots stay verifiable for the 7-year attestation retention period
  • Verifiers poll TUF metadata; a cluster trust bundle is valid for 30 days offline

Risks

  • The root ceremony is an organisational commitment, not a technical one; if the quorum cannot be assembled, rotation does not happen
  • Key service unavailability halts signing but not verification — that asymmetry is deliberate and is what keeps deployments running
◀  Workload Identity and Credentials All views Revocation Propagation  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises30-keys-and-trust-roots