Trust-root and key lifecycle

Status

Scope

Defines how the trust root is established, how keys are issued, rotated, and retired, and who may change any of it.

• Trust-root changes require governed human approval. No administrator, agent, backup, or successor holds automatic root authority.
• Key issuance and rotation are recorded as decisions with the same evidence requirements as any other consequential action.
• Loss or compromise of a key is treated as a containment event, not a configuration change.

Ceremony and custody details are not published. This component is part of the intended architecture; its implementation maturity is reported separately on the development status page.

Evidence required before this label can change

A qualified implementation with preserved assurance evidence, reviewed under the canonical contract for this component. Until that evidence exists, this document remains a design target.