Server Keyring Rotation

The Trust Domain Server (or Signer) uses asymmetric key pairs to sign SVIDs. It uses one to sign X.509-SVIDs, and another to sign JWT-SVIDs. Together, these two keys are referred to as a Key Set.

The Defakto control plane manages the rotation of these keys, and the subsequent updates to the public trust bundles. These signing keys have 90-day lifetimes.

The diagram below illustrates the rotation steps and the state of the server at each step.