Having additional environment variables to point the rmw dds layer towards specific security artifacts, i.e. in vious independent paths, would be helpful in that users wouldn't have to duplicate files like the permission authority public CA certificate into every 'ROS_SECURITY_ROOT_DIRECTORY' directory for each node identity.

This would be helpful for the keymint project, but also in general just to reduce the chance of relaying on a voided CA file for security just because you lost track of an revoked CA certificate somewhere, or free user to choose descriptive filenames as they please.

Last time I tried to be cute and auto generate symbolic links in the file system to point to a single CA on disk, the dds implementation is was testing, RTI Connext, did not acknowledge the links and failed to load the assets. And perhaps justly so, as symbolic linking can itself be a security concern.

I'd suggest checking additional environment variables that could be set to overload the default path to read the assets from, one for each core Secure DDS artifact: identity_ca, permissions_ca, private_key, identity_certificate, governance, and permissions.

This way users could also ensure that identity_ca and permissions_ca are not set to the same public certificate, given the assets they sign often have separate life cycles. Presently this is not possible given SROS2 uses ROS_SECURITY_ROOT_DIRECTORY to load the hardcoded file ca.cert.pem for both CA roles.

Also, perhaps there should be a password environment variable that SROS2 should check to dcypher the private key if encrypted on disk.