Workloads need identity — and today the trust root is a server’s database
🗄️
SPIRE server
trust root in a database
single point to protect & re-key
📦
workload
spiffe://…/svc-a
📦
workload
spiffe://…/svc-b
The server database is the thing everyone must trust — back it up, guard it, and dread the day you re-key it.
BetterSign issues the same SPIFFE identities — trust rooted in a provenance log
📜
Provenance log
the trust bundle, signed & replayable
anyone can verify it
📦
workload
spiffe://…/svc-a
SVID ✓
📦
workload
spiffe://…/svc-b
SVID ✓
Each workload still gets a standard spiffe:// identity and SVID — but issuance is a plog commit, and the trust bundle is a signed log, not a server’s private database.
Rotating the trust root is a signed entry the whole mesh converges on
bundle v1
→
bundle v2
→
bundle v3 ✓ new root
No flag day. Rotate a workload key or the issuing authority as a routine plog update · every verifier replays and converges · no SPIRE server re-key event