Every Secure System Starts With a Root
In cryptography and identity systems, trust must originate somewhere. That origin is called the root of trust — a foundational key, certificate, or hardware module whose integrity underpins every verification decision in a system. PKRoot is dedicated to understanding, building, and advancing the infrastructure that makes digital trust reliable at scale.
Public Key Infrastructure (PKI) is the set of roles, policies, hardware, software, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. It is the invisible backbone of HTTPS, code signing, email encryption, and now passkeys. Every time you see a padlock in your browser, PKI is at work.
The Rise of Passkeys and FIDO2
Passkeys represent the most significant advancement in authentication in decades. Built on the FIDO2 standard and WebAuthn protocol, passkeys replace passwords with cryptographic key pairs. The private key never leaves the user's device; only a public key is registered with the service. Authentication becomes a local gesture — a fingerprint, face scan, or PIN — with the cryptographic heavy lifting handled by the device's secure enclave.
The root of this system is the authenticator attestation: a chain of trust from the hardware security module in your device all the way to a FIDO Alliance metadata statement. PKI makes this attestation chain verifiable. Root certificates issued by device manufacturers anchor the trust that relying parties need when accepting a new passkey registration.
Why Root of Trust Architecture Matters
A compromised root is a total compromise. This is why root Certificate Authorities operate under some of the most stringent physical and procedural security measures in existence: air-gapped hardware, multi-party key ceremonies, HSMs in locked cages, and annual audits. The design of a root of trust — how it is generated, protected, and used — determines the security ceiling for every system that depends on it.
Air-Gapped Root
Root private keys never touch a networked machine
HSM Protection
Hardware Security Modules for tamper-evident key storage
Annual Audits
WebTrust and ETSI audits enforce rigorous compliance
Multi-Party Ceremony
Key operations require multiple humans with split credentials
For platform builders, understanding the trust hierarchy from device attestation through platform authenticator to relying party is essential for deploying passkeys correctly. The chain of certificates, the metadata service lookups, and the attestation verification logic are all PKI concepts applied to the human-scale problem of logging in securely.