Two Dependencies, Total — Operator training

Run a dependency audit on your current CA stack. How many entries came back — hundreds? Now audit each one for the code path that touches your root key.

goca's answer fits in a sentence: pure Go throughout, no frameworks, no ORM, no gRPC, and exactly two direct dependencies — the pure-Go PostgreSQL driver (pgx; the standard library has none) and Cloudflare's CIRCL for the PQC algorithms Go's standard library doesn't carry yet. CIRCL is a deliberately shrinking dependency: it disappears as stdlib coverage lands. Security-critical encoding — the ASN.1/DER for the artifacts the CA signs — is written in-house. Every certificate your CA emits is produced by code you can read end to end. That is the strongest answer there is to supply-chain attacks: there is almost no supply chain to attack.

Metaphor: a kitchen with two suppliers you know by name, versus a food court fed by delivery chains nobody can trace.

Where it breaks: fewer suppliers means growing more yourself — in-house DER puts on goca's own code the burden a library would carry. The compensation is that you can audit it over coffee.

Now I can name both of my CA's dependencies from memory.