Trust and Signing

This guide describes how Stella Ops establishes and maintains cryptographic trust for signed artifacts in air-gapped and sealed-mode deployments: how trust roots are held and versioned, how DSSE and TUF metadata travel inside bootstrap/mirror bundles, how signed time anchors are validated offline, and how to rotate keys without breaking verification.

Audience: operators who package, distribute, and verify Stella Ops bundles in offline estates, and engineers integrating with the Attestor and Air-Gap modules.

For deeper module design, see the Attestor architecture and Air-Gap architecture dossiers.

Trust roots

• Maintain offline root keys for DSSE/TUF; store in HSM or sealed vault.
• Distribute intermediate/leaf keys via bootstrap packs with fingerprints.
• Keep trust roots versioned; record rootVersion and validity period.
• EU compliance artifact verifiers use explicit local trust roots with key id, fingerprint, signer profile, and validity window. See eu-offline-verifier-trust-roots.md.

DSSE

• Use DSSE for bundle manifests (mirror/bootstrap) and evidence timelines when possible.
• Verification in sealed mode uses bundled roots; no online Rekor needed.
• Rotate signing keys with overlapping validity; publish new root in next bundle.

TUF (planned enhancement)

• Current: TUF metadata can be shipped with bundles (root.json, snapshot.json, timestamp.json).
• Planned: full TUF client integration for dynamic trust-metadata distribution. Tracked in the Attestor trust-foundation workstream; see the Attestor architecture dossier for the target design.
• In sealed mode, trust only bundled metadata; no remote refresh.

Signed time tokens

• Export signed time anchors (see staleness-and-time.md):
  • Token fields: issuedAt, notAfter, timeSource, signature, rootVersion.
  • Validate offline against trust roots; expire strictly at notAfter.

Rotation procedure

1. Prepare new root and leaf keys; sign new root with current root.
2. Include new root.json and fingerprints in next mirror/bootstrap bundle.
3. During import, verify both current and new root; switch default after verification.
4. Re-sign manifests/time tokens with new leaf.

Security notes

• Never fetch keys online in sealed mode.
• Keep an audit log of rotations (who, when, rootVersion, fingerprints).
• Enforce least privilege for signing service accounts.

References

• EU offline verifier trust roots: eu-offline-verifier-trust-roots.md
• Staleness and signed time anchors: ../modules/airgap/guides/staleness-and-time.md
• Attestor module: ../modules/attestor/architecture.md
• Air-Gap module: ../modules/airgap/architecture.md