Why every secret key lives in one place
Signing keys, SSH authorities, SAML certificates and sealed secrets belong behind one key service. How envelope encryption and rotation with a grace window work.
Blog3 posts
Security
Keys, certificates and the controls that keep access honest.
Replacing long-lived SSH keys with short-lived certificates
SSH keys copied to servers outlive the people who made them. Certificates signed by a CA expire in minutes, name who may log in and leave a record. How they work.
Step-up authentication: a stronger factor only when it matters
Step-up authentication asks for a stronger or fresher factor only before sensitive actions. Which actions to cover, how fresh a session must be, and how to avoid MFA fatigue.