<mxfile host="app.diagrams.net" agent="architecture-diagram" version="24.0.0">
  <diagram name="TLS Keys in a Facility We Do Not Own — Issue, Deliver, Revoke" id="28-tls-key-custody">
    <mxGraphModel dx="1400" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1500" pageHeight="830" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="n.envoy" value="&lt;b&gt;Envoy · PoP node&lt;/b&gt;" style="shape=umlLifeline;perimeter=lifelinePerimeter;whiteSpace=wrap;html=1;container=0;collapsible=0;recursiveResize=0;outlineConnect=0;size=58;rounded=1;arcSize=8;fillColor=#dae8fc;strokeColor=#6c8ebf;fontColor=#1a2b45;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;spacingTop=9;spacingLeft=38;" vertex="1" parent="1">
          <mxGeometry x="60" y="80" width="210" height="630" as="geometry" />
        </mxCell>
        <mxCell id="_ico1" value="" style="shape=image;html=1;imageAspect=1;aspect=fixed;movable=0;resizable=0;rotatable=0;connectable=0;editable=0;deletable=0;noLabel=1;image=data:image/png,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAYAAADDPmHLAAAABmJLR0QA/wD/AP+gvaeTAAANhElEQVR4nO2de7RXRRXHP1zuvSCogESA+ABRIdJF4iPTFJcC1RJ6YGqrlvbQrFylaZqVtTJLs+zl6qFWhlmKYpiPTMtMfJCKCLLwAaaigiQmD8F7VS733v7Y9+Tx3PPYM3Mev9/vznetDSx+Z2b2nNlnz549e/aAh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHR6OhX9UMNAh2Bz4JvAPoBhYBfwDWV8mUR/GYCswHtiEDH6YtwFeA5sq48ygEA4ATgUfoPehxtAx4TyWceuSKUcB5wEvoBj5MXcBVwPCymfZwx/7I4G3FfOCj9CKiPbztVeNoBY4FFuI+6HG0ADEYPWoMI4FzgNUUM/Bh2gpcBAwspWceqZgCXA68RvEDH6V/AzOK76JHFP2BWcAdlD/ocTQPeHuhPfYAYARwLrCGYgYyziegpQ3AZ4Gmwnrfh/EuRM23UczAPwmcDgzt+XuLQ12LgQOKeQ19C028qea7yH/QO3vqnkXvpd0Y4E8OdXcAlwA75PUy+hKGIF/hKor52jcj2mSSgpdZwHMOba0BPmr3Gvoe9ka+mlcpZuCfQpaJwwz5GoQs+Toc2r4F2M2w3T6BJmAa8oKKUPPdwH2IY6i/I6+Tgfsd+GhDBNBvMAE7AqcAT1DMoG9B1Pw7c+a7H+IOftmBt0eAg3Pmq24wGvg5blZ2Gj0NnIlY80X3Y64Dn53ALxB7p89gMrCRYgb+H8CHKH8NPgOxLWz5Xgt8rGSeK8MD5DvoryM7ffuW2YkYDES2ml/Hvi93ARNL5rtUDCe/gV+LvPBa25/fE/g79v16DenXgJL5LgXjcB/4u4FjcLfmi0Q/JL7QJvAkoMeRcLWGwq7Yq/l5wLvLZ9kJwxCfRif2gtBQG0wjMev8fxB1OKICXvPEocBy7IVgA+IVrfsNpqHoOrwKOB5oqYbNQtACfA23jax7yN+nUSoGoevo/KoYLAHjgL9gLwRbgfOpbRsoES3oOnlLpNxeiHXdSDgGt3iGG6nTKUFjEP0tUmYBsjz6No21PNoB+Bn2AShnlM+yOzSOkrsiZcIhXyuBI8titiRMAR7CXABWVcGsCSYjFnAYm8nu2MJImb9Gfu9Czu01zPIImdO/CGzCTAhMt7ULRzSC59zI75odtEWRMjclPLeRBlkehTAKcW1rBWDXatjsjWHA2fSO4Dk/8txasju1LFLm+oznF1L9XkDe0ArB+KqlP4jgWQ38EBgb+T26lu9Q1Gla5hBgCY0Vf7dJ+VxrFQIQjuBZAZwGDE54Nmq1b1XU32pRprmHjydojPg7TZ+hZAHYAYngeRSZ42eSfUjSZjCjZTRaI8AYZMqo9/i7mhKAvZEInheQECuTQ5E2GiBa5keIL8AEMxFB/TL1GX+nFoCiGOiHqPl5uJ2U+X2k3gcVZTYk8HQssM6Ch3qMvzsXXd+OKKLxicDDSgay6NpI3fcqyrSl8DYcuALz6OF6i787C12/3pd3w83Iadc8Bn8t8OlI/Xcqymnm/MOAxyx5qof4u9PQ9WdW3g0fpmw4jR4EPkH8/HSbsg6NbdMKfANot+DxdmC8oo2q8Hl0/Zidd8MfVjYcpa3ANWRH7SR59aJkknRhD/SCFaZ24JsUaEg54DPo+pC7NpupbDigdciRKa1LMsurF5CNQ2cW8Lwh/93IqeBpFu0ViRPQ8X5i3g1PVza8BPEJbGdY/9XK+m2jfYcgHkGblUstxd8dj47nk/NueKqi0ahhZ4I5ivq7gZ0d2gA4CBFSUyF4mdrwJGqn4lPzdgRpHBDPO9Sv9eq5xgMuQoTgTOSksRbDEU1wnGP7rtC+p9w9gW9oGnWov0wP1zbgp0gOgBsNyvUDfkK1QamVuYJtfPV51+/aRhSrgY8g5wa12msM1W4xlyIAY4ALeGseXFMB2B44yqDNKn3cNyPa4MeIdsjCqAJ40EL7nlpsBOAQxEW7CnGkvM2w4fDg9Ed2Bq9CZ0FXvcnRhrhZNYZelf6B3DVAkDr1X0gETfjgRXiu0xgf4RfTgcyZJyABm1khWmrjRvmcLdYonqnSBlAby1kCEKROfQaxbuPSnoc7amoEhhkdioQ5p51gqVoDBCja1nGFswbYH9m7fxbx1I1Jq8Sw4agAdEV+PxRYijhkopFCXgB0sBKAVuDjyGbMYsRTp/GpuwgAxKurFmRHaxlvDcjQaJi4NvJG0ctdV2jf04BmZM49A7neZLRFY+EpwDZmL+nEzvie37aFntWgFjRAXfgBmoHvILtaeaAL+aLTOm8a59fKm0EetWIENtQU8DmLBrqQrdmjgMsMG4++mFORmzSSYKph4trIGw0lACbHg15B3Jx7IRsO/7RoPPpi5iGBopfS2yCMPl9PAlAPU0BLEzq1+hSSoGAsYis8k/JsVn1xL2YTogkORAzQpOdrZQqwOaBSJjqJ/5iiaG0i3WJcCHwACe3+AboTJ1kWaNoR7SWIr+Fs3pz3w89rrduiDz12ku0Orvooumql0kS6upiDxL91GzScpX6yvoxtSCz/BCTduo0GOI/ir2mz0XRlQuWVzRIAG1WaJQDaL+MFxP38eOj/tijLBu7lRykuitfU1ikbKkM1awooQgBM6+wM/XsF+mkAZEduLpI1JO80MQ0jAHlrgKwBcnkxW4ArLcrNQFKt5RnF6wXAsmHXF3MWYiyaYiDwXcS9fIQjD+Bu6xSNhhWAV5EDKL/GzDgNMBHxX1yJWxLJhtEAtW4DxKEd8WAehhh6pgjy8a4ATsLuLt9aFYDtgS8AuyiezdQANmqszBezENgPOcZtEr0bYCfgt8ih030My9baFDAO2bp/DvgVugsvWrIEwMaZkdcyMAnRAyXbkNiBfYFbLes8FLErLkIykmpQKxrgSCRqObjQaieDsq2Qft7ucguGsk7v2KjsMJYi17okHW2ejVsWzVXA0Qo+FmTUc49pxwwwCLlh1CWJdDc93sx5KQ/MsWAu6/TOeuQWT1uEk0RcQ3z0rWsWzW7EC5kWCZV1scMD9l1MxG6IS369QT/S6CWAP6Y8cLUFk5cpGu5AdhW3t6g/miRiI2IQxoW3TUFO+di+oM1IoGpccuUJyGoiqezDFn1LwuGIQLoIdBz9jp4/kh643oLZbxkwEBy6MEFSkoiFxOcfss2iGR3MA2PqDlzOcalnlhv2K4qByDHvpQ58p9FKepbBaV/sTRaMT8L8lotbgN2V9QebU3F0cUq5nYHrDPkK0zYk2VVcmphhiL0U7vdKZX+iCA7cuFwZk0YvIomz/x9we0nKw7dZduJsC8bagK+SvXy6OaWOSxS8vR8xIm1f4FqSD38egngau0mPmUgqey2yuihi4Bcj+QB6rcIuTil0p2EnwpiNXNtiyuhyeieJDiNtlXGpkrftkK/sDQv+wh/HHjF1NyPuas0UMAAZFJts3xrqQLRe2vvkgpQK7lV0Ig1DgV9iPiV0Ab8hfk07GEkrG3cR8xWG/E1CbhKzfcHtSEo20zX/aCQY90WHttPov8CF6LyBnJdSUV5LGVtrfD3i+Ilz1e6LHFULP3+VBW/BXb4uc642TUxw4OY1h7bSaAWyatE6swD4ekqFNrtuSWjuYU6T8z9KScfFohcxz3Xgz/Wati5EAKMbTC1IYMsdlvVmUSdiRE/Dbk+DM1Mq70DUbVIyZxvsCvw5pc0kegP4HvF5hYLAjxty4O9w7HIIBvQykgZnJLIkfsGhrjTagNhvY107fJKisWeRDGB54oPIxoVpx58i2Q08LifeXHIIhr/MIgb+MSQPYG4f5Xj0Hqb5KA0LJQYjAaBxBl0WXYd7MqgRSLj7ycSrT9scgnlToOanJ/DpjHMMmElzj9piMnC/AQ8BbUK8fKa8HIQkog5fQnUfyWldjkN3W0ne9Aqyp1HKtXezMZuvHgYOyLH9JkS1bTTgIaCHEAs7DQMRgzFtNbIV2WyJU69DEE9g3v74OHoS+BIV3GAyGNkT13ayE1nW7JgjDyMRa9omo3ccLzsjS12TZd4aktPA7Icubb0N3YesGCq/2fMAzFK+BzH8eWI6dpnHA16mIasNly/2BuJtnv7YL2mjtAVxlk20f1XFIOjkK+g7cyv5WeIgavt8dBdGFkWbEJshDmOQbVqbep9BluCa0K1KMRqzu+jaEZWrdY8GKnp1Srk9yQ7AyJs2o7/i5mh6X3mXRIGar7uraI5GpFb7ArM2daYiy8qoil5GfDKqIJK3qG3SgFYiKwtTA2wQYj/FbTC1I2HsdX8/YdBJ7ZZldFNnAPApsoMcAoMu7pTvcCSS19RIzOLzduQktGv21F0Q38JcJNrqdIo9pFoJ9kF3f09A65A7d0wvbVqHRNzEOT/eiwSYugx8YIBNcH8lfQ/9EDdyXgGKafT9BB5akM2sNsP6nkYSY9XLJVA1jZ0QdZ2nSu5Gppl5ZAQz9GAcsgLJqrNuDbB6wBHI1auuA78OOcRp4+c/lt6GahsioKYnfzwsMADZArUJeFiCGIiuJ4daEGE8BYk4LjpdjEcMtLto4WAGjwbELMTBEx34TUj0ze7VseYBBe0tR7AjEiFzMOL0uRs50tVeQtseHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHn0O/wORhuCGcER3MgAAAABJRU5ErkJggg==;" vertex="1" parent="n.envoy">
          <mxGeometry x="9" y="17" width="24" height="24" as="geometry" />
        </mxCell>
        <mxCell id="n.node" value="&lt;b&gt;Node agent · TPM&lt;/b&gt;" style="shape=umlLifeline;perimeter=lifelinePerimeter;whiteSpace=wrap;html=1;container=0;collapsible=0;recursiveResize=0;outlineConnect=0;size=58;rounded=1;arcSize=8;fillColor=#e1d5e7;strokeColor=#9673a6;fontColor=#3a2b44;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;spacingTop=9;spacingLeft=38;" vertex="1" parent="1">
          <mxGeometry x="290" y="80" width="210" height="630" as="geometry" />
        </mxCell>
        <mxCell id="_ico2" value="" style="shape=image;html=1;imageAspect=1;aspect=fixed;movable=0;resizable=0;rotatable=0;connectable=0;editable=0;deletable=0;noLabel=1;image=data:image/png,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAABmJLR0QA/wD/AP+gvaeTAAACkklEQVRoge3ZSchNYRzH8Q8ZIrEwZOGVsDGVDBlCio2FDZFhJ5ZWlJWtDQtlRzY2siApslAkG0NRMs/KsDAPZXjd1+I5J8/13ss51z333Df3W6fnOc/599zf79znef7nOYcO5dIvZ3x/bMJ6jMOAJun4iEvYjXtN6rMX/XAYPQUeH7CgKANrCxafHrflHxmZKPrux8f0rKL65zAwOkfsvzIma2AeA60k8xBqVwOZqbUMLsOk6PwEXrZGTi9WoCup9+Ao3sQBsYHlmIidwhqfclN5BrYKJlLm4AqO4fXvwTfVXhEWJdfP1LlexLEs+c1Tda5vTEXH/8B+TMFqjMxye0rgDB7ictoQG9iblHcxL2p/VbyuulzAp6T+Qxje9xvtrIwh9Ff6/DLa5w3UygOzVOeBs8qbB4sxNqlXcBqf6wXPwhphlrfrMrpHWCWHpaLjf+AQpmW4K2WyLSk3CE/HVQZO4gXmixy2GdcFjbfShtjAjqTchblR+7viddXlGgYm9Qq2CyYaopMHiqDPG6iVB7pUb+nu+PU80momY0RS7xHG//d6wV2YjRvaNw9sE/LVoFT078vojAx3pUz2JOU6HKHawEV8w1QMaa2uzDzEWzxNG2IDW5LyIJZG7V8Kl1Wfl4Jown5go2gzk5dOHiiCPm+gVh4YjlHR+XPlzYOxGJrUK3j8p+Dhwnuhq9o3D2zGhFh0PITO4QFm/sllyRzAI2FTg2oDz4Q19keLReXhs/BG7m3aEM+BlUl5HEui9u7iddXlk19iK1iF84121skDRfBfGfhWmIrefM0amMdAw5vpnHQLr/qbzni8V/wE3leE+JRFeFKQ8IqQqAbnEdTIB+VBWKi5n127hUeYx03ss0NL+AlV99RV7CRFIAAAAABJRU5ErkJggg==;" vertex="1" parent="n.node">
          <mxGeometry x="9" y="17" width="24" height="24" as="geometry" />
        </mxCell>
        <mxCell id="n.spire" value="&lt;b&gt;SPIRE server&lt;/b&gt;" style="shape=umlLifeline;perimeter=lifelinePerimeter;whiteSpace=wrap;html=1;container=0;collapsible=0;recursiveResize=0;outlineConnect=0;size=58;rounded=1;arcSize=8;fillColor=#e1d5e7;strokeColor=#9673a6;fontColor=#3a2b44;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;spacingTop=9;spacingLeft=38;" vertex="1" parent="1">
          <mxGeometry x="530" y="80" width="210" height="630" as="geometry" />
        </mxCell>
        <mxCell id="_ico3" value="" style="shape=image;html=1;imageAspect=1;aspect=fixed;movable=0;resizable=0;rotatable=0;connectable=0;editable=0;deletable=0;noLabel=1;image=data:image/png,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAABmJLR0QA/wD/AP+gvaeTAAACTUlEQVRoge3Zv29PURjH8RdaaTFQkTQGSyNSSaeS+DHZ0MQgYTFJJDYD8T9YzBKJv0AQwcJEYsKCNH7EgMHQ+lHSFFE1nJJv2rrn3HvP/X5Lvu/kTvc5z3k+9/x4nnMuXTrLikS7UZzBCNY0Fw6YwB2cx6ccDg/jO+ba/LzAplhwsRFYh9cYSNNqAl8iNpvRl+jvEk4k2i7JmPQvdhWrEnxuwVSiz/cxZysj76ND2MJjzCbYvRVGKoUB9BQZFL6UvsjhNHrxOWI3iqESfsvEsIjj2r94Fz69RQHGptCypyug03QFdJp/XkAsD9ThmVDP9GEnNjTY11+pkgceCAG30ouTQp2UNQ/kFnAP/QX+dmB6uQqYEQq1GGdzCsi5iG/iTYLdReF8kYWcAh4l2k3hVa5OcwqYK2GbUnYnkVPASKLdWuXK6UJyCjgk7QB0TPFOlZWy2+g1xR9lCJMlfbY1D8zhlqW30zG8q+CvUEATpcRBvBSS2rgw5/dguIG+onSPlE2TYwr9FLLwZTzHDxzALgzim3A5dhsPsRG7hQurrRn6LyQ2hSaxr6LvHpyL+G90F5rF3jrO57lQ0EejAq7UcdzCAL4W9NPYIr5bo20rH/CkauM6AqZqtF3Ix6oN6whIuYlOpfJuWEfAEayu0f432yw+QydTJw/sF/b3cSEXVKFfuK1O/eGxiLqJbHD+6Rj/fCnx3wvIdntQkVmR83NMQOUEk4mnqm8Qf7ihc2eBo3WDh/W43ubAp3EqJbgyfwCHsV3zC38G99UoL7q0k1+Wk5ES1qN1DgAAAABJRU5ErkJggg==;" vertex="1" parent="n.spire">
          <mxGeometry x="9" y="17" width="24" height="24" as="geometry" />
        </mxCell>
        <mxCell id="n.bao" value="&lt;b&gt;OpenBao&lt;/b&gt;" style="shape=umlLifeline;perimeter=lifelinePerimeter;whiteSpace=wrap;html=1;container=0;collapsible=0;recursiveResize=0;outlineConnect=0;size=58;rounded=1;arcSize=8;fillColor=#e1d5e7;strokeColor=#9673a6;fontColor=#3a2b44;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;spacingTop=9;spacingLeft=38;" vertex="1" parent="1">
          <mxGeometry x="760" y="80" width="210" height="630" as="geometry" />
        </mxCell>
        <mxCell id="_ico4" value="" style="shape=image;html=1;imageAspect=1;aspect=fixed;movable=0;resizable=0;rotatable=0;connectable=0;editable=0;deletable=0;noLabel=1;image=data:image/png,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAABmJLR0QA/wD/AP+gvaeTAAACWUlEQVRoge3ZPWgUURAH8F8SBVGMhV8IIqgIgo2llSJRLCQYQSsLS62CNhZa2NhZmMpaQcRSLBQ7I4gimsbEQhQtrggmGGIIqMGcxd7JcmTv4+3bXZT8YWDv9s3sf+bNm7dvllVUi76SntOPQziJA9iJtVhCDVN4gpf4XRKnrrAZNzGNehfyFbewtQqyaQzgCuZ0R7xV5nENa8omDhvxqAey7eS5kmdjB95HIt+UD5I1UzjWSRZhTPJNmcCGoh24k4PgMr5JKlDWmPtFkj8cSHwJ17GlYWcQo1jMGD9UBPk+4alzPsPmkJVn440C9q6jgeTfdrD7MEPvRHpQfwQHTgfqjXe4/yzj/5H0j7wO9OFUoO5A4P1hEdNol/DKM6V9AJ+20d0dy4HQ/G/K5Qy7ZzroHYvlwEhOB5ZxG/sls7EHNyTltZ3e2VgODOd0IFT+OpB3Ec/m1A/FXPMirwO1nPqh+BTT2Bflpk9NqozG2MgmI9joBc2zRhSMSipJmTNwPBb5CxWQfy3SLlwF+bpIr9NVpE0d92KQryryE1ifl3xVkY9yqK8q8uMitFWqiPw8rorQ2Cqb/IweW4vtauooxjqM6RXvJDm9HduwIOmbTuIxXojU3C0i5z82iBeOItJmGnuLINuaHrHSZgw/G9cLuKuEV+9z4kV+U9FkV8KrQLKVOpA+DwyW9dCYiHGgacUMvhdgd0Xk3el+STrJTczikiSNSkfIl5UHVRBNo4gUKhX/lQOLmaOyEaJTGC7qbSP7gSOVME2h9ZXhIPZ1oVeXfGH5HJ3RKv4x/AHr4cvIBpx95gAAAABJRU5ErkJggg==;" vertex="1" parent="n.bao">
          <mxGeometry x="9" y="17" width="24" height="24" as="geometry" />
        </mxCell>
        <mxCell id="n.iss" value="&lt;b&gt;Cert issuer&lt;/b&gt;" style="shape=umlLifeline;perimeter=lifelinePerimeter;whiteSpace=wrap;html=1;container=0;collapsible=0;recursiveResize=0;outlineConnect=0;size=58;rounded=1;arcSize=8;fillColor=#dae8fc;strokeColor=#6c8ebf;fontColor=#1a2b45;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;spacingTop=9;spacingLeft=38;" vertex="1" parent="1">
          <mxGeometry x="1000" y="80" width="210" height="630" as="geometry" />
        </mxCell>
        <mxCell id="_ico5" value="" style="shape=image;html=1;imageAspect=1;aspect=fixed;movable=0;resizable=0;rotatable=0;connectable=0;editable=0;deletable=0;noLabel=1;image=data:image/png,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAABmJLR0QA/wD/AP+gvaeTAAAC9klEQVRoge3ZzWsVVxzG8U9yU7ELFV82lropKL6BYvGFFqmCDRhddePCl0V3gtsuC26KQii6UEEplELR1oXbqK2ii1JEUf+BZhPfW40pQtHYXBcnF+cmM3NOcpM7V/CBZ3V+M/f7nJc758zwXu++uvEtbqEfH5TUbsQVXMT62UdL0z7UM/4VtZy6TRjJ1A2iq02MpTqrOUBeiHV4mlO3uq2kBbpvMlgdPwrTayUeFdQcqoC3SavkgzX8s2L4Oi60CtCTULMbvbgrLL4HmbZtkWv3Rtq/EEZpLMOzBV8KU/A4/klgLNQuzT02hjs4Mv7jF5SPQIr78DXOY3hC263xgNPWsRkAbNWLywBj6e6mZ50V3cOzsoJYgAFv52cVGhBGoVCxAE9UOwoDsYKUBRK9ySxpFFdjRZ0c4A9h61GqvD1LQ2uwB/uFp2m71YNlmIPHeBm7oIYDOKf86VmFX+MGjmJFUYDDHQCa4mdY0oDOroHeomQdpoXCuQLNAa63n2VaGlHw117DT6qfImV+IbKBrAn7+KpB8/xc2KlG1YWTHQCc9TA2p8BnQ+QdFavwK2yYCjzhrPqwA+Ab/sEUzgXr8XcHQE/0WQknyA3CEa5q2CL/UhbiU2GlVw0Z8zkF75MudQBcqrc2oLMLYzQvVYcql3Ud/lJ975Z5FCey0Hlz6RPsGPd2mZ1fRRrE7xkPT+XibmGXWkVvX8aiFMAyjWFpWtYZ1yoJvZ3ydNvZOsu09LFwrC1VLEBNWAtVKdp5sQCbRV7tzbJaDlBl78Pn+LCsIGUK5WkU1zA0daZJ+q3kPmMlDElajJvC39oQzuArzB9v79faX+X/3k7RtfhG+Aj4Ev/hYCvwDXUrXgd9EcBXkfbbBfedi3kzAR/TPMWQz4XXH6cK2uv4vh2QMf1pMtiI8FmVsF05nVNTFz5fVa7vNEP9i88m1NSED34TN2YL2odZrOXC675Gz28tqOsRDiONACfbQpeoJcIz46NIXZcwOhsjde/1zugN/ybiub8tWh4AAAAASUVORK5CYII=;" vertex="1" parent="n.iss">
          <mxGeometry x="9" y="17" width="24" height="24" as="geometry" />
        </mxCell>
        <mxCell id="n.ca" value="&lt;b&gt;Public ACME CA&lt;/b&gt;" style="shape=umlLifeline;perimeter=lifelinePerimeter;whiteSpace=wrap;html=1;container=0;collapsible=0;recursiveResize=0;outlineConnect=0;size=58;rounded=1;arcSize=8;fillColor=#f5f5f5;strokeColor=#8c8c8c;fontColor=#333333;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;spacingTop=9;spacingLeft=38;" vertex="1" parent="1">
          <mxGeometry x="1230" y="80" width="210" height="630" as="geometry" />
        </mxCell>
        <mxCell id="_ico6" value="" style="shape=image;html=1;imageAspect=1;aspect=fixed;movable=0;resizable=0;rotatable=0;connectable=0;editable=0;deletable=0;noLabel=1;image=data:image/png,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAABmJLR0QA/wD/AP+gvaeTAAAC9klEQVRoge3ZzWsVVxzG8U9yU7ELFV82lropKL6BYvGFFqmCDRhddePCl0V3gtsuC26KQii6UEEplELR1oXbqK2ii1JEUf+BZhPfW40pQtHYXBcnF+cmM3NOcpM7V/CBZ3V+M/f7nJc758zwXu++uvEtbqEfH5TUbsQVXMT62UdL0z7UM/4VtZy6TRjJ1A2iq02MpTqrOUBeiHV4mlO3uq2kBbpvMlgdPwrTayUeFdQcqoC3SavkgzX8s2L4Oi60CtCTULMbvbgrLL4HmbZtkWv3Rtq/EEZpLMOzBV8KU/A4/klgLNQuzT02hjs4Mv7jF5SPQIr78DXOY3hC263xgNPWsRkAbNWLywBj6e6mZ50V3cOzsoJYgAFv52cVGhBGoVCxAE9UOwoDsYKUBRK9ySxpFFdjRZ0c4A9h61GqvD1LQ2uwB/uFp2m71YNlmIPHeBm7oIYDOKf86VmFX+MGjmJFUYDDHQCa4mdY0oDOroHeomQdpoXCuQLNAa63n2VaGlHw117DT6qfImV+IbKBrAn7+KpB8/xc2KlG1YWTHQCc9TA2p8BnQ+QdFavwK2yYCjzhrPqwA+Ab/sEUzgXr8XcHQE/0WQknyA3CEa5q2CL/UhbiU2GlVw0Z8zkF75MudQBcqrc2oLMLYzQvVYcql3Ud/lJ975Z5FCey0Hlz6RPsGPd2mZ1fRRrE7xkPT+XibmGXWkVvX8aiFMAyjWFpWtYZ1yoJvZ3ydNvZOsu09LFwrC1VLEBNWAtVKdp5sQCbRV7tzbJaDlBl78Pn+LCsIGUK5WkU1zA0daZJ+q3kPmMlDElajJvC39oQzuArzB9v79faX+X/3k7RtfhG+Aj4Ev/hYCvwDXUrXgd9EcBXkfbbBfedi3kzAR/TPMWQz4XXH6cK2uv4vh2QMf1pMtiI8FmVsF05nVNTFz5fVa7vNEP9i88m1NSED34TN2YL2odZrOXC675Gz28tqOsRDiONACfbQpeoJcIz46NIXZcwOhsjde/1zugN/ybiub8tWh4AAAAASUVORK5CYII=;" vertex="1" parent="n.ca">
          <mxGeometry x="9" y="17" width="24" height="24" as="geometry" />
        </mxCell>
        <mxCell id="_m7" value="1. TPM quote · measured boot" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.1460;exitDx=0;exitDy=0;entryX=0.5;entryY=0.1460;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.node" target="n.spire">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m8" value="2. SVID · 1 h" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=open;endFill=0;dashed=1;strokeColor=#5a6570;exitX=0.5;exitY=0.2095;exitDx=0;exitDy=0;entryX=0.5;entryY=0.2095;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.spire" target="n.node">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m9" value="3. new key pair for the LHR cert set" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.2730;exitDx=0;exitDy=0;entryX=0.5;entryY=0.2730;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.iss" target="n.bao">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m10" value="4. ACME order · DNS-01 · LHR key" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.3365;exitDx=0;exitDy=0;entryX=0.5;entryY=0.3365;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.iss" target="n.ca">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m11" value="5. certificate · 14 days" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=open;endFill=0;dashed=1;strokeColor=#5a6570;exitX=0.5;exitY=0.4000;exitDx=0;exitDy=0;entryX=0.5;entryY=0.4000;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.ca" target="n.iss">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m12" value="6. fetch LHR key set with SVID" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.4635;exitDx=0;exitDy=0;entryX=0.5;entryY=0.4635;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.node" target="n.bao">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m13" value="7. response-wrapped keys" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=open;endFill=0;dashed=1;strokeColor=#5a6570;exitX=0.5;exitY=0.5270;exitDx=0;exitDy=0;entryX=0.5;entryY=0.5270;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.bao" target="n.node">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m14" value="8. seal to TPM · plaintext in memory only" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.5905;exitDx=0;exitDy=0;entryX=0.5;entryY=0.6286;entryDx=0;entryDy=0;align=left;spacingLeft=6;" edge="1" parent="1" source="n.node" target="n.node">
          <mxGeometry relative="1" as="geometry">
            <Array as="points">
              <mxPoint x="480" y="450" />
              <mxPoint x="480" y="480" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="_m15" value="9. SDS push · no restart" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.6730;exitDx=0;exitDy=0;entryX=0.5;entryY=0.6730;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.node" target="n.envoy">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m16" value="10. renew at day 5 · alert by day 8" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.7365;exitDx=0;exitDy=0;entryX=0.5;entryY=0.7746;entryDx=0;entryDy=0;align=left;spacingLeft=6;" edge="1" parent="1" source="n.iss" target="n.iss">
          <mxGeometry relative="1" as="geometry">
            <Array as="points">
              <mxPoint x="1180" y="550" />
              <mxPoint x="1180" y="570" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="_m17" value="11. stolen PoP: evict its node entries" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.8190;exitDx=0;exitDy=0;entryX=0.5;entryY=0.8571;entryDx=0;entryDy=0;align=left;spacingLeft=6;" edge="1" parent="1" source="n.spire" target="n.spire">
          <mxGeometry relative="1" as="geometry">
            <Array as="points">
              <mxPoint x="710" y="600" />
              <mxPoint x="710" y="620" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="_m18" value="12. revoke LHR certificates only" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;dashed=1;strokeColor=#b85450;fontColor=#b85450;exitX=0.5;exitY=0.9016;exitDx=0;exitDy=0;entryX=0.5;entryY=0.9016;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.iss" target="n.ca">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="title" value="TLS Keys in a Facility We Do Not Own — Issue, Deliver, Revoke" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=20;fontStyle=1;fontColor=#16202c;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="20" width="1410" height="30" as="geometry" />
        </mxCell>
        <mxCell id="rule" value="" style="line;strokeWidth=1;html=1;strokeColor=#c9d3de;" vertex="1" parent="1">
          <mxGeometry x="40" y="50" width="1410" height="10" as="geometry" />
        </mxCell>
        <mxCell id="note" value="Each PoP has its own keys. A stolen server exposes one PoP's keys for at most 14 days, and no other PoP needs new certificates." style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=10;fontColor=#8a97a5;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="760" width="1410" height="20" as="geometry" />
        </mxCell>
        <mxCell id="foot-rule" value="" style="line;strokeWidth=1;html=1;strokeColor=#e3e9ef;" vertex="1" parent="1">
          <mxGeometry x="40" y="780" width="1410" height="10" as="geometry" />
        </mxCell>
        <mxCell id="foot" value="v 1.0   ·   owner Security Architecture   ·   date 2026-09" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=9;fontColor=#9aa7b4;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="790" width="1410" height="10" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>
</mxfile>
