BetterSign™

What BetterSign Adds

WireGuard is intentionally small and fast, but its peer identity model is fixed around WireGuard public keys and optional preshared keys. BetterSign does not replace that kernel protocol.

Instead, BetterSign manages the surrounding control plane: which VLADs are allowed as peers, which WireGuard public key belongs to each peer now, which endpoint and allowed IP policy applies, and when a preshared key should rotate.

The result is identity rotation without the headache. The WireGuard interface can keep running while BetterSign verifies peer lifecycle events and applies local configuration updates.

See WireGuard rotation in action — one signed entry, and every peer reconfigures itself with a post-quantum preshared key.

Peer Identity State

The stable peer identity is the VLAD. The WireGuard public key is just current state, usually read from /data/wireguard/pubkey or a configured per-peer override.

That distinction matters during laptop rebuilds, server replacement, incident response, and algorithm migration. A peer can rotate the WireGuard public key without becoming a new organizational identity.

BetterSign can also track peer endpoints, allowed IPs, and trust-anchor paths in local configuration. The plog supplies verified identity state; the operator still controls local network policy.

Post-Quantum PSK Rotation

WireGuard supports an optional preshared key. BetterSign can use authenticated control-plane messages to derive and rotate that PSK independently of WireGuard key generation.

The exchange can use classical, post-quantum, or hybrid KEMs resolved through verified BetterSign identity state. Supported choices include ML-KEM, SNTRUP, FrodoKEM, Classic McEliece, X25519-ML-KEM-768, and X25519-SNTRUP761.

After a successful exchange, the daemon writes the new PSK material and applies the WireGuard configuration. The tunnel gets PQ hardening without asking operators to manually copy shared secrets between hosts.

Supported KEX Families

The WireGuard PSK rotator can be configured with a KEX algorithm appropriate for the deployment. Operators can choose conservative classical fallback, NIST-standard ML-KEM, SNTRUP variants, FrodoKEM variants, Classic McEliece, or hybrid modes.

Because the KEX choice is configuration and identity state, migration does not require changing the peer identity. A deployment can move from X25519 to hybrid or PQ-only PSK rotation while followers continue to know the same VLAD.

Rotation Without the Headache

BetterSign makes WireGuard rotation ordinary. Public keys, preshared keys, endpoints, and identity metadata can change as verified lifecycle events instead of manual edits across every server.

The server follows peer VLADs, verifies the latest plog state, updates only the relevant tunnel configuration, and applies it idempotently. Operators get audit continuity because changes remain attached to the same peer identity.

This is especially useful for fleets: a laptop replacement, key compromise, or PQ migration can be handled as a signed update under the same VLAD rather than a new peer identity that every administrator has to redistribute.

Developer Commands

WireGuard integration is configured per interface. A daemon tracks peer VLADs, resolves their WireGuard public keys from plog state, and optionally rotates PSKs on a schedule with jitter.

Local route policy, private key storage, and interface names remain local configuration. BetterSign supplies verified identity state and authenticated rotation messages.