This is what zero-trust looks like at the infrastructure layer. Identity and encryption match the lifetime of the thing being secured.

If your certificate strategy still assumes stable names and year-long validity, it is already behind reality.

letsencrypt.org/2026/01/15/6...

Short-lived and IP certificates make it possible to use TLS before a DNS name exists, reduce friction for DNS over HTTPS adoption, secure ephemeral devices and services by default, and shift trust from long-lived credentials to automated renewal.

👇

TL;DR we've constructed an entire compliance industry around optimizing metrics that have become disconnected from the underlying reality they were supposed to measure.

In complex systems, oversight that depends on snapshots will fail predictably. Data without continuous interpretation does not produce safety.

Regulators oversee continuously changing systems using periodic exams. That mismatch is structural.

SVB wasn’t a surprise. Regulators had leading indicators and documented findings. Risk accumulated while interpretation and enforcement lagged.

The whole premise of a compliance team governing complex systems they barely understand is broken. Compliance in a complex system has to be a continuous team sport, a natural byproduct of the way teams work. Not an annual bolt-on.

The same will be true everywhere. Scale and velocity outpace our ability to reason. The audit still passes. The gap just grows faster.

Now consider that AI is writing 30% of the code at Google and Microsoft. The humans who understood what the system does, and whether it matches what the policy claims, understand less every quarter.

I wrote up some thoughts on how we got here: unmitigatedrisk.com?p=1116

I also use this as a kind of low pass filter. It’s reasonable to expect a security leader to understand the concepts behind the systems they protect. You don’t need to be an expert to grasp the abstract properties; it’s an opportunity to practice humility and curiosity as well.

Some thoughts on that here: unmitigatedrisk.com?p=1109

No a few years ago they switched to their own root store. They do pull in certificates that the user adds but not the platform root store.

Full analysis here → unmitigatedrisk.com?p=1092