PKI: the cryptographic half of the identity gap
This section is the staging ground for pki.sgit.ai — a site collecting the published work on public key infrastructure, and a registry of agent keys designed from a documented failure. It lives here first because it is the cryptographic half of this site's thesis: the shared-drives research found that no available system gives an agent its own identity, agent-level attribution, or encryption to a specific agent. Per-agent keys in a registry are what would fill those empty rows.
The pages
Why good public key repositories don't exist
The global keyserver network was destroyed in 2019 by an attack its own maintainer called unsalvageable — and the cause was a stated design goal, not a bug. The three abused properties, and what the replacement gave up.
Read → The designThe four rules, published before the registry exists
Only the owner writes to their own record; revocation is a signed append; records are size-bounded; every entry is signed. Plus: identity vs. mandate, and what vaults do and don't supply.
Read →Why attempt this now
The registry idea is old; what changed is that vaults supply the layer a key server had to build itself: distribution (a published vault is readable from static hosting and mirrorable by anybody), custody without access (untrusted mirrors are safe by construction), and versioning (the state of a key at any past date is answerable natively). What vaults do not supply — the ownership rule, the size bound, signature checking — is the registry logic, and it is the part to build carefully. The registry becomes a product of existing infrastructure rather than a new system.
The material exists, in depth
729 files in the corpus mention the subject, with dedicated documents going back to February 2026: an architecture debrief, a messaging implementation, model-integration research, a document identity brief, operating modes, a provenance treatment, and a brand strategy. So pki.sgit.ai is a publication and curation problem, like this site — organise by the question a reader arrives with, promote the strongest artefacts to pages. The curation queue is tracked on comms.
Build order (from the brief)
- The collection, organised by question, with the February–March architecture material promoted.
- The failure page — short, useful, independent of anything being built. Done, here.
- The four rules, published as the registry's stated design before the registry exists. Done, here.
- A private registry, for our own agents — the smaller problem, with a real user.
- Mandate statements, separate from identity statements, revocable independently.
- A public registry, last: it inherits every hard problem of the private one, plus trust roots and abuse.
The load-bearing ordering: a registry with one organisation's agents in it is testable; a global one is a commitment.
How this connects to the rest of the site
- The thesis — the identity gap this is the cryptographic half of.
- Shared drives research — the three empty rows a per-agent key registry would address.
- Hope § attribution from content — signed writes are the attribution mechanism; the registry is where the verifying keys would live.