Skip to content

Milestones

List view

  • Phase 11 — The rest

    Delegated KEK unwrapping, gateways for CAs that lack one, real-hardware verification of the Azure and F5 deployers, agent enrolment approval, and keystore formats host inventory cannot read. The unimplemented policy rule types were on this list and are not any more: #21 made every rule type enforce something or say it cannot.

    No due date
    •0/3 issues closed
    0% complete3 open0 closed

  • Phase 10 — Post-quantum

    The half that is possible today. crypto/tls carries X25519MLKEM768 in Go 1.26, so post-quantum key exchange can be measured across the estate and used on CertPilot's own channels. ML-DSA issuance stays blocked on crypto/mldsa, deliberately.

    No due date
    •0/1 issues closed
    0% complete1 open0 closed