The enrollment heads are the parts of your CA closest to hostile networks — DMZs, client regions, the open internet. So ask the attacker's question: what is in one?
Almost nothing. Each head parses one protocol, authenticates an enrollment principal, and calls api-cert. It holds no CA key and no database credential — the CMP head, the last to carry one, gave its credential up on 2026-08-09. A head fetches its own serving certificate and reports liveness over the management API, like the console does. The manual's summary line is the one to remember: compromising a head yields a bounded RA credential, never a CA key.
That bound is what makes the deployment freedom safe: you can push a head into a DMZ precisely because the blast radius of losing it is a revocable credential and the traffic it saw.
Now I can say what an attacker gets from a compromised protocol head — and what they never do.