qarc↗ CA sign in

POST-QUANTUM CERTIFICATE INFRASTRUCTURE

FIELD NOTES / 001

Cryptography changes.
Trust must hold.

The algorithms are moving.
Build the authority to move with them.

qarc brings post-quantum signatures, explicit issuance policy, and inspectable evidence to private certificate infrastructure.

Inside the system

IN DEVELOPMENT · PRIVATE-PKI LAB

The qarc continuity mark Nested architectural arcs cross a shared baseline, a visual metaphor for changing cryptography and a continuous trust boundary. This is not a live security measurement. 01 / CONTINUITY 02 / CHANGE Q—001
CHANGING PRIMITIVES. EXPLICIT BOUNDARIES.FIG. 01

01 / THE SYSTEM

IDENTITY → POLICY → EVIDENCE

A certificate is a promise.
Make the terms explicit.

Not just a new signature algorithm. A deliberate chain from authority to identity—with controls you can examine.

01

ESTABLISH IDENTITY

Your hierarchy.
Your trust domain.

Issue certificates for services and clients you control. Separate root and issuer keys. Keep subscriber private keys local.

ML-DSA / CLASSICAL
02

CONSTRAIN ISSUANCE

Policy before
the signature.

Declare client capabilities, pin acceptable roots, and constrain issuance with independently approved, signed policy catalogs.

EXPLICIT ADMISSION
03

RETAIN THE EVIDENCE

Inspect what
actually happened.

Trace certificate inventory, signing attempts, hash-linked audit records, and revocation status. A success message is not the whole story.

VERIFIABLE OPERATIONS

02 / TRUST BOUNDARIES

NO BORROWED ASSURANCE

Trust is earned.
Not decorated.

No wall of badges. Here is the operating boundary, in plain language.

See the developer workflow
01

Private does not mean publicly trusted.

Private certificates are for relying parties you control. qarc does not currently offer publicly trusted TLS issuance.

02

Cryptography is not the whole control.

Distinct root and issuer keys establish separation. Custody, recovery, and access governance remain essential operational responsibilities.

03

Tests are evidence. Not certification.

Native cryptographic and independent interoperability tests inform development. HSM qualification and independent security review remain separate requirements.

PRODUCTION ISSUANCE DISABLED Admission work is still in progress.

03 / FOR BUILDERS

LOCAL KEYS. VERIFIED OUTPUT.

Keep the key.
Check the receipt.

The enrollment client submits a signed CSR, persists a retry reference, and verifies the returned certificate against your pinned hierarchy before writing output.

ENROLLMENT / CLILAB WORKFLOW
  1. 01 Generate your key locally
  2. 02 Submit a signed request
  3. 03 Verify against pinned trust
npm run enroll -- config.json service.pem

Requires the qarc source checkout, trusted configuration, an authorized credential, and an enabled isolated lab authority.

TWO ENTRIES. DISTINCT AUTHORITY.

FOR INDIVIDUALS & DEVELOPERS

CA application

Account and social sign-in.
Your identity, without implied workspace access.

SIGN-IN IN DEVELOPMENT FOR ORGANIZATIONS

Enterprise workspace

A separate organizational login.
Workspace membership is its own boundary.

SIGN-IN IN DEVELOPMENT