THE GOLD STANDARD OF JUDGEMENT · SPECIALIST STUDY
Rotate decision-receipt signing keys without breaking present trust or rewriting historical authority
A signed OWA decision receipt is useful only when a verifier can identify the authorised signer, validate the receipt bytes, understand when the signature was created and apply the trust rules that were valid for that decision. Key rotation therefore has two simultaneous duties: introduce a new trusted key for future receipts and preserve defensible verification of old receipts. Compromise makes the problem harder because revocation should stop future reliance without automatically declaring every historical receipt false. A disciplined programme separates signer authority from key possession, cryptographic validity from business acceptance, signing time from trusted timestamp evidence, and live trust-store migration from archival validation. It also rehearses emergency revocation before the organisation needs it.
This guide belongs to the Judgement subject root, the Gold Standard of Education, and the How X Works hub. It begins with a concrete decision, then tests whether the method still holds when the context changes.
Choose a reading route
Define trust and authority · chapters 1, 2, 3
Design rotation and overlap · chapters 4, 5
Handle compromise and time · chapters 6, 7, 8
Migrate consumers and archives · chapters 9, 10, 11
Exercise revocation and govern · chapters 12, 13
The whole problem at a glance
| Trust question | Required evidence | Unsafe shortcut |
|---|---|---|
| Who could sign? | Versioned authority record | Key exists |
| When was it signed? | Trusted time evidence | Self-declared time |
| Should it be accepted now? | Policy and revocation state | Signature valid |
| Can history still verify? | Archived chain and algorithm | Live trust store |
Cryptographic verification alone does not prove the decision was authorised or acceptable.
CHAPTER 1 OF 13 · Define trust and authority
1. Separate signature validity from decision trust
A valid signature proves that the protected bytes verify under a public key. Decision trust also requires an authorised signer, accepted algorithm, applicable policy, intact schema and evidence that the receipt belongs to the claimed decision context.
Evidence record: Record receipt bytes, canonicalisation, signature, algorithm, key identifier, signer identity, authority version, policy, schema, decision ID, verification result and exceptions. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Expose each trust component separately so a verifier can reject, quarantine or limit use for the right reason. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A signature verifies but the signer role expired before the decision; report cryptographic validity and authority failure separately. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 1 check · what should survive an audit
- State the decision unit for “Separate signature validity from decision trust”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 2 OF 13 · Define trust and authority
2. Build an authoritative signer and key inventory
Map people, services, roles and delegated signing authorities to keys, certificates or trust anchors. Include activation, overlap, suspension, retirement, compromise and archival-verification states.
Evidence record: Retain key ID, public material, owner, service, role, approval, purpose, algorithms, environments, activation, cryptoperiod, custody, consumers, revocation route and archive requirement. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: No key enters production until its purpose, authority, custody and consumer population are explicit. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A disaster-recovery signer uses a separate key; inventory its narrower authority rather than treating it as equivalent to the primary signer. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 2 check · what should survive an audit
- State the decision unit for “Build an authoritative signer and key inventory”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 3 OF 13 · Define trust and authority
3. Define the rotation contract before generating a key
Specify why rotation occurs, which receipts use the new key, the overlap window, cutover rule, consumer readiness, rollback, archival preservation and maximum old-key signing time.
Evidence record: Publish rotation ID, driver, scope, algorithms, generation ceremony, activation, overlap, cutover, rollback, monitoring, approvals, notifications and evidence retention. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Freeze the contract before cutover; emergency compromise follows a separate accelerated path. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A scheduled cryptoperiod rotation permits overlap; suspected compromise may require immediate stop with no old-key signing grace. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 3 check · what should survive an audit
- State the decision unit for “Define the rotation contract before generating a key”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 4 OF 13 · Design rotation and overlap
4. Generate, protect and attest the replacement key
Use approved generation, custody and access controls appropriate to the signature system. Bind the new public key to the signer authority through the real trust mechanism, not an informal announcement.
Evidence record: Preserve generation evidence, module or service identity, approvals, key ID, certificate or trust-anchor binding, access policy, backup decision, audit log and activation test. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Do not copy old private-key material into a new identifier and call it rotation. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A cloud signing service changes region; verify key identity, custody and audit access before activation. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 4 check · what should survive an audit
- State the decision unit for “Generate, protect and attest the replacement key”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 5 OF 13 · Design rotation and overlap
5. Use overlap without creating ambiguous authority
During overlap, declare which signer is preferred, which receipts may still use the old key and how duplicates or re-signing are represented. Verifiers should not choose authority merely by whichever signature they can validate.
Evidence record: Record policy version, receipt issue time, signer selection, permitted old-key cases, dual-sign rules, re-sign lineage, conflict resolution and observed use. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: End old-key signing at a precise event and test that no queued or offline service can continue silently. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: An offline signer returns after cutover with queued receipts; quarantine them instead of backdating acceptance. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 5 check · what should survive an audit
- State the decision unit for “Use overlap without creating ambiguous authority”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
Worked key-lifecycle register
| Key state | Receipt interval | Verifier action | Archive need |
|---|---|---|---|
| Active K2 | After cutover | Accept under current policy | Preserve chain |
| Retired K1 | Before cutover | Verify historical use | Keep public material |
| Compromised K0 | Time bounded | Apply revocation policy | Preserve incident evidence |
| Unknown key | Any | Reject or quarantine | Investigate lineage |
Actual algorithms, certificates and legal effects depend on the deployed signature system.
CHAPTER 6 OF 13 · Handle compromise and time
6. Distinguish compromise time, discovery time and revocation time
These times answer different questions. A key may have been misused before discovery; a revocation notice may arrive later still. Historical receipts require a policy for what evidence can establish signing or existence before the compromise boundary.
Evidence record: Retain suspected compromise interval, detection, containment, forensic basis, revocation decision, publication, consumer receipt, affected services and uncertainty. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Do not assign a precise compromise time unless evidence supports it; preserve bounded intervals and confidence. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Audit evidence narrows compromise to a three-hour interval; treat receipts inside it differently from receipts months earlier. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 6 check · what should survive an audit
- State the decision unit for “Distinguish compromise time, discovery time and revocation time”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 7 OF 13 · Handle compromise and time
7. Use trusted timestamp evidence carefully
A self-declared signing time is part of the signed statement but does not independently prove when the signature occurred. A trusted timestamp or verifier-supplied challenge can support timeliness when its own trust chain, policy and preservation are valid.
Evidence record: Preserve timestamp token, authority, policy, message imprint, receipt signature linkage, validation chain, revocation state, clock basis, collection time and archive copy. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Claim only the time assurance the evidence supports; do not upgrade a logged application time into trusted timestamp proof. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A receipt says 10:00 but its trusted timestamp is 10:04; use the timestamp assurance and explain the interval. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 7 check · what should survive an audit
- State the decision unit for “Use trusted timestamp evidence carefully”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 8 OF 13 · Handle compromise and time
8. Design historical verification after key retirement
Retirement ends new operational use; it should not erase the public material, algorithms, policies and authority records needed to verify old receipts. Preserve a validation package that can survive service and trust-store changes.
Evidence record: Archive receipt, signature, public key or certificate, chain, trust anchor, revocation objects, timestamp evidence, authority record, algorithm parameters, schema, policy and validation software notes. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Keep private keys only when a separate, justified requirement exists; historical signature verification normally relies on preserved public evidence. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A certificate directory is decommissioned; export the required chain and status evidence before shutdown. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 8 check · what should survive an audit
- State the decision unit for “Design historical verification after key retirement”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 9 OF 13 · Migrate consumers and archives
9. Migrate consumer trust stores by population
Inventory online verifiers, batch jobs, mobile or offline clients, partner systems, archives and manual review tools. Distribute new trust material through authenticated channels and observe actual activation.
Evidence record: Track consumer identity, owner, trust-store version, distribution channel, receipt, activation, last verification, offline interval, errors, exceptions and rollback state. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Do not infer migration from package publication; require point-of-use verification for material consumers. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A partner downloads the bundle but has not restarted its verifier; keep it unready until a test receipt succeeds. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 9 check · what should survive an audit
- State the decision unit for “Migrate consumer trust stores by population”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
Emergency revocation gate
| Gate | Pass evidence | Remain unsafe when |
|---|---|---|
| Authority | Revocation actor authenticated | Ambiguous order |
| Distribution | Consumers receive state | Offline trust store |
| History | Time-bounded policy tested | Blanket invalidation |
| Recovery | Replacement signer operational | Unsigned gap |
A fast notice that verifiers cannot consume is not an effective revocation.
CHAPTER 10 OF 13 · Migrate consumers and archives
10. Test mixed trust-store and rollback states
During migration, some consumers know both keys, some only the old key and some only the new. Exercise accepted, rejected, unknown and revoked receipts and confirm that fallback does not turn failure into unsafe acceptance.
Evidence record: Retain test matrix, consumer version, receipt fixture, expected policy result, observed result, diagnostic, rollback action, retest and unresolved differences. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: A rollback may restore verification availability but must not reactivate a compromised signing key. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Roll back a faulty new verifier while keeping the new public key and the old compromised key revoked. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 10 check · what should survive an audit
- State the decision unit for “Test mixed trust-store and rollback states”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 11 OF 13 · Migrate consumers and archives
11. Validate archives across versions and algorithms
Sample receipts before, during and after rotation, including retired and revoked keys, schema changes and timestamp evidence. Recreate validation in an isolated environment with preserved dependencies and documented limits.
Evidence record: Preserve sample frame, receipt hashes, validation package, software and algorithm support, trust policy, expected result, observed result, discrepancies, repairs and independent review. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Archive success means reproducible policy evaluation, not merely that signature bytes parse. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A newer crypto library disables an old algorithm; use an isolated historical verifier and record why current policy still limits use. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 11 check · what should survive an audit
- State the decision unit for “Validate archives across versions and algorithms”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 12 OF 13 · Exercise revocation and govern
12. Exercise emergency revocation end to end
Simulate or safely trigger an authorised revocation notice, stop signing, publish status, distribute to online and offline consumers, verify rejection, activate the replacement and preserve historical validation rules.
Evidence record: Record trigger, authority authentication, notice content, channels, publication times, consumer receipt, enforcement, signing stop, replacement activation, missed consumers and recovery. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: The drill fails if any material consumer continues accepting newly issued receipts under the revoked key. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: An offline batch verifier reconnects after the drill; confirm it processes revocation before queued receipts. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 12 check · what should survive an audit
- State the decision unit for “Exercise emergency revocation end to end”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 13 OF 13 · Exercise revocation and govern
13. Close rotation with bounded trust claims
Publish what keys, receipts, consumers and archives were tested, which remain exceptional, how historical verification works and which events automatically reopen migration or revocation response.
Evidence record: Retain final inventory, cutover evidence, old-key stop proof, consumer states, archive results, incident links, residual risks, next review and trigger catalogue. Preserve the source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the conclusion rather than inherit confidence.
Decision rule: Avoid saying every historical receipt remains trusted; limit claims to tested evidence, time and policy. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A later archive sample lacks timestamp evidence; reopen that receipt class without invalidating unrelated verified history. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 13 check · what should survive an audit
- State the decision unit for “Close rotation with bounded trust claims”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
Verification lab: work the decision twice
Build a key-lifecycle table for active K2, retired K1 and compromised K0, then classify four receipts by signature, authority, time and policy evidence.
Test a mixed consumer population where online services know K2, one offline client knows only K1 and a partner has downloaded but not activated the new trust bundle.
Run an emergency revocation exercise that stops signing, distributes status, rejects new K0 receipts, activates a replacement and still validates a pre-compromise historical receipt under bounded policy.
Limits and misconceptions
A valid signature is not a valid decision
Authority, policy, schema and context still matter.
A signed time is not necessarily trusted time
Use independent timestamp or verifier evidence where required.
Retired is not compromised
Retirement can preserve historical trust; compromise requires a time-bounded risk decision.
Revocation should not erase history
Preserve evidence needed to evaluate old receipts under the correct policy.
Questions readers ask
Why rotate decision-receipt keys?
- For cryptoperiod limits, compromise response, algorithm change, service migration or authority change.
Can both keys be trusted during overlap?
- Yes when the rotation policy defines their permitted uses and the old signing stop is controlled.
Does revocation invalidate every old receipt?
- Not automatically. Apply the governing time, compromise and historical-validation policy to preserved evidence.
What proves when a receipt was signed?
- Trusted timestamp or verifier-supplied evidence can strengthen timeliness; a self-declared time alone is weaker.
How is an offline consumer migrated?
- Through authenticated trust material, bounded grace, point-of-use tests and reconciliation before unrestricted acceptance.
What should archives preserve?
- Receipts, public trust material, status evidence, timestamps, authority and policy records, schemas and validation context.
Practise, verify and continue
Rotate OWA receipt signing keys while preserving signer authority, trusted time, consumer migration, archive validation and emergency revocation across active, retired and compromised states.
Apply the method to signed assessment reports or approval receipts. Keep cryptographic validity, organisational authority and historical policy as separate reviewable claims.
Practical evidence check
Before implementation, write a one-page evidence map with the decision, unit of analysis, version or time boundary, inputs, outcomes, uncertainty, authority and stop rule. Attach one worked case that passes and one that fails. A reviewer should be able to reproduce the reasoning without relying on the memory of the person who built the system.
Run one changed-context rehearsal before approval. Alter a mechanism rather than a cosmetic detail, then identify which calculation, safeguard or governance gate must change. Record any conclusion that does not transfer. This short rehearsal is often the fastest way to expose a hidden assumption before it becomes an operational dependency.
Related eduKate reading
OWA decision-receipt schema evolution
OWA re-release post-remediation surveillance
OWA release-discrepancy triage
OWA scenario-library release deployment
Authoritative sources and scope
NIST SP 800-57 Part 1 Rev. 5 key-management guidance
NIST SP 800-102 recommendation for digital-signature timeliness
NIST FIPS 186-5 Digital Signature Standard
NIST OSCAL assessment-results model and evidence structure
NIST sources support key lifecycle, digital signatures, time evidence, revocation concepts and structured assessment results. They do not define OWA receipts or this exact trust-migration workflow. Algorithms, certificate handling, timestamp services, legal effect, privacy, retention and signing authority must be set by the real system and applicable policy.