Created by @CMCDragonkai

Allowing KN root certs to be trusted by an external CA allows PK KNs to be integrated into an existing PKI. Whether that's a public PKI or private PKI, it increases our compatibility with existing infrastructure.

This would be an interactive thing as PK has to generate a CSR. However our certificates don't have any kind of common name with respect to domains or anything, so I'm not sure if internet CAs will have any use here.

This requires some research.

Additional Context

Regarding: https://github.com/MatrixAI/Polykey-Design/issues/14

A "Public Key Infrastructure" PKI is fundamentally a centralised key server for handing out asymmetric keys/certificates representing identity in organisations or some trusted context. The DOD is one of the largest users of such a thing.

Alot of existing "user management" systems are in corporate LDAP systems. And lots of software at the end of the day integrate into LDAP for centralized user authentication. Consider that alot of single sign on systems integrate into LDAP such as SAML. https://auth0.com/blog/how-saml-authentication-works/

Polykey is not an enterprise authentication or identity system. So that's great. However we do envision that Polykey gets used by enterprises, and secrets are often associated with "people". But also machines as well. And that's what we want Polykey to be serving, the people that have associated identities in enterprise identity systems. But also machines that require secrets to be distributed including TLS certificates and other sorts of stuff.

Polykey unlike Vault, sits on both sides, the client side and the server side. And any server acts like a client as well. That's the really cool part in that it also supports complex integration on the end-user side. Thus allowing push/pull logic, and allowing flexibility in where that logic initiates.

That leads to be my other idea. Each Polykey agent can be a certificate authority. And each agent like a web of trust system, or a hierarchical X509 system is able to sign other polykey agents, and any hierarchy is what allows polykeys to push secrets to other polykeys.

Meaning an "identity server" is one representation of human identities. However asymmetric cryptosystems provide significant advantages at the trade off of some increased technical complexity. Thus PK/PKE can offer a way to bridge the gap between traditional user identity systems and asymmetric crypto systems, a sort of "hybrid identity system" that is both centralized and decentralized at the same time.