The classic PKI bypass isn't broken crypto — it's the side door: the one enrollment channel where policy was implemented a little differently, a little later, by a different team. goca closes that class of bug structurally.
Template policy is resolved server-side, for every channel: the REST API, bulk requests, ACME, operator issuance — and the roadmap protocol heads will join the same list, because there is only one list. The RA decision pins the exact template version and resolved values; the issuer lints the final TBSCertificate against that decision. A protocol head may narrow a template but cannot loosen it or substitute its own policy — the pipeline it feeds would refuse the result.
The same property makes dry runs meaningful. The console's template dry run shows field provenance, CA binding, algorithm and validity limits, approval outcome and final extensions without issuing anything — and because the identical check runs at enrollment, a successful dry run is evidence of policy compatibility, not the output of a parallel implementation that might disagree with production.
One policy, one evaluator, every door. When you audit template enforcement, you audit it once.
Now I can say why no enrollment channel can loosen a template — and why a dry run is real evidence.