One Pipeline, Many Doors — Operator training

Every enrollment protocol you add sounds like a new attack surface on the CA itself. In goca it isn't — because a protocol head is a translator, not a second CA.

Heads speak a standard enrollment protocol to clients and act as registered, scoped RAs on the issuance plane (api-cert). They hold no CA key, no database credential, no platform KEK. Deploy them beside the core, in a DMZ, or in a client region; compromising one yields a revocable RA/enrollment credential — never the CA.

Every protocol uses the same endpoint model (frame 44): a versioned document with a default template, allowlist, authentication policy and permissions. The endpoint's logical CA comes from its template binding, so generation rollover is invisible to clients whichever door they entered by.

Metaphor: many doors into one lobby — every visitor, whatever entrance they used, passes the same single security desk.

Where it breaks: in most buildings a door is a way past the desk if it's badly hung. Here a door structurally can't be: heads can only ask api-cert, and behind that sit the RA decision, the issuer's lint and keysvc — the pipeline no door can shortcut.

Now I can say what a protocol head is — a translator with a revocable badge, not a second CA.