Decentralized PKI

BetterSign™

BetterSign gives people, servers, services, and subsystems stable cryptographic identities whose keys and protected metadata can change safely over time.

Stable identity

A VLAD remains stable while its keys and protected metadata rotate.

Self-verifying history

Every state transition is hash-linked and authorized by the previous log state.

Decentralized discovery

VLADemlia helps peers locate current records without becoming the trust root.

Routine rotation

Key changes become signed updates that followers can verify and apply.

Decentralized PKI

Overview

What BetterSign Is

BetterSign is a decentralized PKI and secure change-monitoring system. It treats an identity as a stable VLAD with an append-only provenance log behind it, rather than as one static key file.

Keys, SSH access, TLS material, WireGuard metadata, admin policy, certificates, and protected application data are state inside that log. Peers verify the log before trusting the current state.

Why It Exists

Key rotation is usually avoided because the operational blast radius is high. SSH keys, API tokens, deploy keys, and service credentials are copied into many systems, then become fragile to replace.

BetterSign separates identity from the current secret. Rotation becomes a signed log update that following systems can verify and apply automatically.

Core Promise

A peer can start with a VLAD, fetch the matching provenance log, replay and verify it, and derive the current keys and protected data without asking a central authority to vouch for the result.

The network distributes records. Trust comes from the VLAD, hash-linked log entries, authorization scripts, and signatures or proofs inside each accepted update.

How It Works in 60 Seconds

The whole system is one loop: a stable name, a signed history behind it, and anyone able to replay that history to reach the current truth — with no authority in the middle.

The BetterSign Loop

You get a VLAD — a permanent, verifiable name made of math
Every key change is a new signed page in its provenance log
You publish the new head once to the VLADemlia network
Followers pull it, verify every page themselves, and converge
They always land on your current, correct keys — no authority asked

See It In Action

Three short looping demos make it concrete: how a key rotates and every follower converges, how anyone verifies a log by replaying it, and how BetterSign gives AI agents a verifiable identity. Watch key rotation, watch verification, and watch agent identity.

Identity Stable VLADs survive key rotation
State Append-only provenance logs
Transport VLADemlia DHT