Three Keys, One Certificate — Operator training

What happens when the internet-facing part gets popped? In goca: not much. The API records your request and asks the RA. The RA decides against the template and signs its decision — with a key it doesn't hold. The issuer verifies that signature with a public key, builds the exact certificate bytes, lints them, and records a purpose-bound intent. Only then does the key service sign — after checking who's asking, what for, and whether an intent for exactly those bytes exists.

Each compromise buys less than you'd think: a popped front door can't create an RA decision or call the key service; a popped RA holds no signing key and can only ask; a popped issuer can't forge the RA's signature. No externally reachable component can mint a certificate alone.

Metaphor: a bank transfer needing three signatures on one slip — teller, manager, vault officer — each checking a different thing.

Where it breaks: bank officers can collude over lunch. These three run in separate containers on separate network segments.

Now I can explain why a popped front door can't mint a certificate.