BetterSign™

The Third Path

Web PKI solves key status lookup with centralized authorities, but that makes trusted third parties part of the failure surface. PGP-style web of trust removes the central authority, but key rotation and revocation propagate slowly and unreliably.

BetterSign combines decentralized trust with efficient lifecycle distribution. Authenticity comes from VLADs, plog history, locks, unlocks, and proofs; distribution can use public infrastructure without making that infrastructure the root of trust.

Keys Are Not Identities

Many systems use a public key as both the identifier and the verifier. That can be elegant for short-lived or ephemeral actors, but it becomes brittle when the identity is supposed to outlive any one key or algorithm.

When identity and key are the same object, normal security hygiene becomes socially and operationally expensive. Rotating an SSH host key can look like a man-in-the-middle attack. Replacing a user login key means updating every authorized_keys file. Migrating from one algorithm to another can feel like abandoning the identity itself.

That pressure causes keys to live longer than they should. Operators avoid rotation because the cost is not just cryptographic; it is distribution, audit continuity, access control, monitoring, policy enforcement, and human recognition all tangled around one public-key value.

BetterSign breaks that coupling. The VLAD is the durable identity, while keys and algorithms are current state inside a verifiable provenance log. A key can be replaced, revoked, recovered, delegated, or upgraded without forcing relying parties to learn a new identity.

Lifecycle Events Are First-Class

BetterSign treats key changes as normal identity activity, not as exceptional maintenance. Creation, rotation, revocation, recovery, delegation, and algorithm migration are signed lifecycle events in the provenance log.

That changes the operational posture. A strong system should expect keys to age, move, fail, and be replaced. The relying party should not have to guess whether a changed key is a breach, a renewal, a recovery action, or a planned algorithm upgrade.

Because lifecycle events are part of the same verifiable history as the identity itself, followers can see what changed, who authorized it, which policy accepted it, and what state is current now.

The practical result is that key changes can become routine. Organizations can shorten key lifetimes, rotate aggressively, adopt post-quantum or hybrid algorithms, and recover from exposure without forcing identity resets or manual redistribution.

Business Risk

Key management is a business problem of trust, complexity, and fragility. Organizations need strong cryptographic control, but expired certificates, unclear key ownership, brittle renewal processes, and CA incidents can create outages and emergency remediation work.

BetterSign reduces that fragility by making lifecycle changes routine, verifiable events. Rotation, revocation, and recovery are not exceptional manual projects; they are part of the identity state machine.

Key changes should be normal operating procedure. A healthy system expects keys to age, move, fail, and be replaced, then gives relying parties a provable way to follow those changes.

Alternatives and Limits

DIDs, blockchain PKI, and identity-based encryption all address parts of the same problem, but each introduces tradeoffs. DIDs can improve user control, but DID documents still need key update broadcast, distribution, and relying-party synchronization. Many DID methods do not provide a built-in, provable provenance log for every key lifecycle event, so rotation and recovery history can become method-specific or external to the identifier.

Blockchain PKI adds transparency but can introduce cost, latency, and ecosystem constraints. IBE simplifies public-key lookup but depends on a key generation center.

BetterSign focuses on stable identity, verifiable lifecycle history, flexible distribution, and local verification. It can integrate with existing identity systems when introduction or real-world verification is needed, without requiring that system to become the universal root of cryptographic truth.

Shorter Certificate Lifespans

Certificate lifespans are getting shorter, which increases the cost of manual certificate lifecycle management. More frequent renewal means more opportunities for outages if rotation remains a brittle operational task.

BetterSign is designed around frequent, verified lifecycle changes. The same pattern that handles a key rotation can also drive watchers for TLS material, service identity, SSH access, and other local integrations.

Flexibility Without Fragility

BetterSign supports multiple distribution mechanisms and storage options. Operators can use public services for reachability, local daemons for automation, and stronger custody for higher-priority keys.

The flexibility does not weaken the trust model because fetched data remains untrusted until local verification succeeds.