A certificate that expires in ten minutes
Artefacts are signed without anyone holding a long-lived key. A short-lived certificate is issued against the workflow's identity, used once, and thrown away — nothing to store, nothing to rotate, nothing to steal.
Which raises a problem: by the time anyone verifies the signature, the certificate expired long ago. As drawn, verification always fails.
Outside every boundary: Verifier (checks it days later), Signed artefact, Certificate authority (issues for 10 minutes), Build (proves its identity), an empty slot for the records when signing happened Connections: Build calls Certificate authority — identity (step 1) Certificate authority calls records when signing happened — cert + signature (step 2) Signed artefact calls Verifier (step 3) records when signing happened controls Verifier — valid at signing time (step 4)