Operationalizing Key Management for Regulatory Compliance and Emergency Response
summary
Describes a concrete, repeatable system: a state-driven automated pipeline that adds a new key, pushes the new public key to all verifiers, waits for measurable distribution, then pivots signers to the new private key and only after fleet certificates refresh distrusts the old key. Emphasizes idempotent state transitions, rollback capability, public key distribution before private pivot, hitless updates, avoiding firmware-bound keys, tiered SLOs for hygienic versus emergency rotations, quarantine of stragglers, and audit trails keyed by identifier and timestamp for provable compliance.
AI-written summary · about
chapters (13)
- 0:00Key management challenges
- 1:42Emergency response risks
- 2:47Sovereign cloud regulations
- 3:30Key lifecycle fundamentals
- 4:59Asymmetric key challenges
- 6:41Key rotation scenarios
- 9:31Certificate rotation patterns
- 12:40Automated key rotation pipeline
- 15:50Incidents in rotation pipelines
- 18:18Tiered rotation SLOs
- 21:49Observability in key management
- 23:14Dual-purpose infrastructure
- 24:39Key takeaways
related talks
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...
51mKey Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!
38mPKI deployments are as unique as any snowflake; how to build equally flexible PQ migration strategie
27mNo Keys? No Problem: Why You Can Trust Sigstore Signatures
29mKeys, Certs and Vault: From DevSecOps to Post-Quantum
38mHow to Distribute Keys Securely for 20% of the Web
46mAchieving Quantum Readiness: A Comprehensive Approach
49mKeylime: Bootstrapping and Maintaining Trust