Stable identity
A VLAD remains stable while its keys and protected metadata rotate.
BetterSign vs. the alternatives
How It Compares
The Landscape
Proving identity online is not a new problem, and BetterSign is not the first attempt. It is worth being clear about how it relates to the approaches you already know, and where it genuinely differs.
Traditional PKI leans on certificate authorities you are told to trust. The PGP web of trust pushes trust out to your social graph. SPIFFE and SPIRE give workloads portable identities issued by a central server. Each solves part of the problem and leaves part open — usually the part where keys have to change.
Side by Side
The same questions, asked of each approach. The last column is BetterSign; highlighted cells are where it differs most.
Approaches to Identity and Trust
A fair reading: the alternatives are genuinely strong in their own columns — see below.
| Traditional CA / PKI | PGP / Web of Trust | SPIFFE / SPIRE | BetterSign | |
|---|---|---|---|---|
| Root of trust | A trusted certificate authority | People you already trust | A central server and its database | A signed log you replay yourself |
| Identity when keys change | Re-issued cert, trust re-bootstrapped | A new key looks like a new person | SVID re-issued by the server | The VLAD never changes |
| Key rotation | Manual and risky; often avoided | Painful; rarely done | Automated, but server-bound | Routine signed entry in the log |
| Revocation | CRLs / OCSP, often lagging | Revocation certs seldom seen | Driven by the server | A signed entry the network converges on |
| Decentralized | No — central authorities | Yes, but hard to use | No — central server | Yes |
| Offline / long-term verify | Needs a CA or OCSP reachable | Works if you hold the keys | Needs a bundle from the server | Yes — replay the log anytime |
| Post-quantum | Depends on the CA | Limited | Depends on deployment | First-class |
| Who decides truth | You trust the CA’s word | You trust whoever signed | You trust the server | Math you can check yourself |
Where the Others Still Win
A fair comparison admits the alternatives are strong where they are strong. Certificate authorities and X.509 have unmatched tooling and browser ubiquity; if you need a certificate a browser trusts today, that is still the road. SPIFFE and SPIRE have a rich, mature ecosystem for workload identity inside a cluster. The PGP web of trust, for all its friction, needs no infrastructure at all.
BetterSign is designed to interoperate rather than replace: it can issue X.509 and SPIFFE-style identities and speak the same formats, while moving the root of trust to something you can verify for yourself. Reach for it where key rotation, self-verification, and long-lived identity matter most.
The Best of Each
The goal is not to discard what works, but to keep it and remove the part that hurts.
What BetterSign Keeps and Adds
- From PKI
- the compatibility of X.509 and standard tooling
- From the web of trust
- no central authority you are forced to trust
- From SPIFFE / SPIRE
- short-lived, automatically rotated workload identities
- BetterSign adds
- a permanent identity and a history anyone can replay and verify
Trust root A log you verify, not an authority
Interoperates X.509, SPIFFE/SVID, SSH, PGP
Where it wins Rotation, self-verification, longevity