pki.sgit.ai
A key registry for agents, designed from a documented failure
Screenshots captured 2026-08-19 · v0.1.2 when captured · SGit-AI__Website__PKI ↗
Publishing the design before the implementation
The premise is unusual and worth stating plainly: this site describes a registry that does not exist. That is deliberate. Publishing the rules now is cheap; claiming them afterwards is impossible. If something ships that breaks one of them, the site is the evidence.
The failure it is designed from
In 2019 the global keyserver network was flooded with garbage signatures until importing a poisoned certificate would break your installation. Its own maintainer called it unsalvageable. The cause was not a bug — it was a design goal stated at the outset.
That design goal was append-only. And append-only is a pattern this project relies on in five places, which is exactly why a shrug would not do. The site's resolution is a precise one, and it is the most useful idea on the page:
- Append-only, owner-writes — only the record's owner may write to it. Every entry is attributable because the owner signed it; a record grows slowly, in one hand; something can be withdrawn by a signed append that supersedes it.
- Append-only, anyone-writes — anybody may grow anybody's record, without limit, and garbage is indistinguishable from signal. Nothing can ever be withdrawn, by design. This destroyed the network.
The rule to carry forward is not "append-only". It is the writer owns what it writes.
The four rules
Each one turns around a specific property the 2019 attack abused:
- Only the owner writes to their own record — turns around anyone may append to anybody's certificate.
- Revocation is a signed append, not a deletion — signed by the key being revoked, so it is self-authenticating, the record stays append-only, and what a key said before revocation stays checkable.
- Records are size-bounded — one poisoned key reached about 150,000 signatures because certificates had no limit. The bound is a stated parameter, with the honest cost that it will one day reject a legitimate record.
- Every entry is signed — so nothing anonymous can accumulate.
Rule 2 is the one to notice. Deletion and append-only are usually treated as incompatible; making revocation a signed statement appended by the revoked key itself resolves the contradiction without weakening either property.
Why it is relevant here
sgit's own PKI ships keypairs today — RSA-OAEP 4096 for encryption, ECDSA P-256 for signing — and has no revocation, no directory and no web of trust, which the limitations page says plainly. This site is the design work for what a directory would have to be before it could responsibly exist.
The connection to append lanes is direct: a lane is append-only and owner-configured — a sender writes only to a lane the owner registered for them. That is rule 1, already shipped, in a different corner of the system.
Sections
- The failure — 2019, with sources
- The rules — four commitments, each tied to the property it turns around
- Mandate — what a registry would be for
- Build order — private before public, and why