A federation signing key was held for a year; how do you re-establish trust with relying parties you cannot compel?

## Why this is a principal-level problem Everything technical about replacing a signing key is well understood. What makes this hard is that the parties who must act are not yours. The issuer's owner has authority over the key and no authority over the acceptors, and the acceptors are the ones whose action determines whether the old key is still good. That is an organisational problem wearing a cryptographic hat. ## Part one: you do not know who trusts you Start with the acceptor set, because everything else is scheduling against it. It typically has three strata: - **Automatic consumers** that periodically fetch published trust material. These move on their own once you publish, and they are the easy majority. - **Manual consumers** where somebody once pasted a certificate into a configuration screen. These need a human on the other side, in their change window, with a ticket you cannot raise. - **Unknown consumers**: integrations built years ago, subsidiaries, acquired businesses, a customer who federated to you as part of a deal nobody remembers. These surface only when they break. The honest deliverable here is a list plus a stated confidence, not a claim of completeness. If your programme's plan assumes the list is complete, the third stratum will find you at cutover. ## Part two: leverage decides your schedule Sort the acceptors by what moves them. Internal systems move because you own them. Customers and partners under contract move because a clause obliges them, and you should know before the meeting whether such a clause exists. Everybody else moves when it suits them, and a large customer may simply refuse a date that collides with their own freeze. The mechanism that keeps them working during this is publishing both keys, and it is a genuine cost rather than a formality: while the old key is still published and accepted, whoever holds it keeps minting identity. So the overlap window is the exact quantity being traded. Shorten it and you break slow relying parties, possibly including revenue-bearing ones. Lengthen it and you extend the exposure you are trying to end. Making that call, with a number and a named owner for the parties who miss it, is the decision the question is actually asking about. ## Part three: the claim you cannot make Because forged identity involves no issuance, there is nothing at the issuer naming the identities that were forged. A year of exposure therefore cannot be converted into a list of affected accounts. What you can state defensibly is the window during which forgery was possible, the reach (anything trusting this issuer would have accepted it), and what has changed since. This matters commercially. Customers and regulators ask for a list, and the pressure to produce a plausible one is real. A list assembled from partial sources will be read as complete and will be wrong, and the correction is far more expensive than the original honest bound. Decide the wording of that bound once, centrally, and make every conversation use it. ## Part four: what you change so that the next one is cheaper The design outcome, not the response, is what a lead is judged on afterwards: - **Rehearse replacement.** A trust anchor that has never been rotated on a calm Tuesday cannot be rotated safely on a bad one. Regular, boring rotation converts a crisis into a procedure and shrinks the overlap you will need. - **Publish trust material in a form consumers fetch automatically**, and make automatic consumption a condition of new integrations, so the manual stratum stops growing. - **Maintain the acceptor inventory as a live thing** with an owner, because the inventory is what bounds every future statement you make about reach. - **Constrain who can invoke signing**, so that possession of the appliance holding the key is not the same as the ability to issue identity unobserved. - **Prefer credentials a relying party must resolve with the issuer** at the relationships you could least afford to lose, accepting the coupling that comes with it. ## The trap to name out loud The seductive framing is *rotate the key and we are done*. Rotation is the easy hour. The programme is the six weeks of chasing parties who do not report to you, with an exposure clock running the whole time, and a statement to customers you must be able to defend without over-claiming.