# pki.sgit.ai, A key registry for agents, designed from a documented failure, sgit.ai > Good public key repositories existed and were destroyed. This site is the 2019 keyserver catastrophe, the four registry rules it produces, and the build order, all published before the registry exists, so the commitments are checkable against whatever eventually ships. *Source: · site v0.6.8 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../index.md) / [Network](index.md) / pki.sgit.ai # pki.sgit.ai A key registry for agents, designed from a documented failure Screenshots captured 2026-08-19 · `v0.1.2` when captured · [SGit-AI__Website__PKI ↗](https://github.com/SGit-AI/SGit-AI__Website__PKI) [Open pki.sgit.ai ↗](https://pki.sgit.ai) ## Publishing the design before the implementation The premise is unusual and worth stating plainly: **this site describes a registry that does not exist.** That is deliberate. Publishing the rules now is cheap; claiming them afterwards is impossible. If something ships that breaks one of them, the site is the evidence. The home page. The claim is historical before it is technical. ## The failure it is designed from In 2019 the global keyserver network was flooded with garbage signatures until importing a poisoned certificate would break your installation. Its own maintainer called it **unsalvageable**. The cause was not a bug. It was a design goal stated at the outset. That design goal was **append-only**. And append-only is a pattern this project relies on in five places, which is exactly why a shrug would not do. The site's resolution is a precise one, and it is the most useful idea on the page: - **Append-only, owner-writes**: only the record's owner may write to it. Every entry is attributable because the owner signed it; a record grows slowly, in one hand; something can be withdrawn by a signed append that supersedes it. - **Append-only, anyone-writes**: anybody may grow anybody's record, without limit, and garbage is indistinguishable from signal. Nothing can ever be withdrawn, by design. This destroyed the network. The rule to carry forward is **not** "append-only". It is *the writer owns what it writes*. ## The four rules Each one turns around a specific property the 2019 attack abused: Each rule states the property it turns around, so it can be checked rather than trusted. 1. **Only the owner writes to their own record**: turns around *anyone may append to anybody's certificate*. 2. **Revocation is a signed append, not a deletion**: signed by the key being revoked, so it is self-authenticating, the record stays append-only, and what a key said before revocation stays checkable. 3. **Records are size-bounded**: one poisoned key reached about 150,000 signatures because certificates had no limit. The bound is a stated parameter, with the honest cost that it will one day reject a legitimate record. 4. **Every entry is signed**, so nothing anonymous can accumulate. Rule 2 is the one to notice. Deletion and append-only are usually treated as incompatible; making revocation a *signed statement appended by the revoked key itself* resolves the contradiction without weakening either property. The history, in five minutes, sourced rather than summarised from memory. ## Why it is relevant here sgit's own [PKI](../docs/pki.md) ships keypairs today (RSA-OAEP 4096 for encryption, ECDSA P-256 for signing) and has **no revocation, no directory and no web of trust**, which [the limitations page](../docs/limitations.md) says plainly. This site is the design work for what a directory would have to be before it could responsibly exist. The connection to [append lanes](../api/append-lanes.md) is direct: a lane is append-only and *owner-configured*, a sender writes only to a lane the owner registered for them. That is rule 1, already shipped, in a different corner of the system. ## Sections - **The failure** (2019, with sources - **The rules**) four commitments, each tied to the property it turns around - **Mandate**, what a registry would be for - **Build order**, private before public, and why [← All network sites](index.md) --- *[Site index for agents](../llms.txt) · [HTML version](https://sgit.ai/network/pki.html)*