THE GOLD STANDARD OF JUDGEMENT · SPECIALIST STUDY
Respond when a retired OWA signing key appears in a new decision receipt
An old key in a newly observed receipt can mean delayed delivery, replay, unauthorised new signing, clock error, failover drift or compromise. Those states require different responses, yet the first hours must protect consumers without destroying the evidence needed to separate them. A strong incident process stops affected signing, preserves receipt bytes and trusted-time evidence, bounds producers and consumers, evaluates archive consequences, uses revocation policy deliberately and repairs decisions that relied on uncertain authority. Trusted re-entry is staged and independent; it does not erase the incident or weaken historical verification.
This guide belongs to the Judgement subject root, the Gold Standard of Education, and the How X Works hub. It begins with a concrete decision, then tests whether the method still holds when the context changes.
Choose a reading route
Preserve and contain the receipt · chapters 1, 2, 3
Reconstruct chronology and scope · chapters 4, 5
Protect consumers, archives and decisions · chapters 6, 7, 8
Revoke, repair and independently test · chapters 9, 10, 11
Restore trusted signing and learn · chapters 12, 13
The whole problem at a glance
| Incident question | Required evidence | Unsafe shortcut |
|---|---|---|
| Was it newly signed? | Trusted time and producer logs | Arrival time |
| Who may rely? | Consumer denominator | Known API clients |
| Is history affected? | Archive validation policy | Revoke everything |
| What may resume? | Independent key-path test | Service restarted |
Historical verification may remain valid while new old-key signing is forbidden.
CHAPTER 1 OF 13 · Preserve and contain the receipt
1. Preserve the exact receipt and observation context
Capture receipt bytes, detached content, signature, certificate chain, timestamp token, status objects, transport wrapper, first observer and local clocks before any re-signing or parsing rewrite.
Evidence record: Retain cryptographic digests, encodings, source and destination, receipt schema, key ID, claimed times, trusted times, first observation, validator output and custody. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Work from immutable copies; generated screenshots or reserialised JSON cannot replace the signed object. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A parser normalises field order; preserve the original bytes and use the normalised view only as an analysis aid. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 1 check · what should survive an audit
- Define the decision unit for “Preserve the exact receipt and observation context”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 2 OF 13 · Preserve and contain the receipt
2. Contain affected signing without erasing history
Stop or isolate the signer, HSM slot, failover job or environment that may create new old-key receipts. Preserve logs, queues, configuration and keys under controlled access.
Evidence record: Record containment time, scope, services, HSM state, credentials, queued work, failover paths, emergency actions, continuity signer and evidence preservation. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Apply the narrowest reliable stop; do not delete the old public certificate or archive material needed for historical validation. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Disable the retired private-key slot while keeping its certificate and trusted timestamps available to validators. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 2 check · what should survive an audit
- Define the decision unit for “Contain affected signing without erasing history”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 3 OF 13 · Preserve and contain the receipt
3. Open authority, cryptographic and decision workstreams
Assign incident command, signing authority, HSM and platform owners, PKI or certificate authority, consumer owner, archive and records lead, decision-remedy owner and independent reviewer.
Evidence record: Maintain role map, authority, access, conflicts, communications, evidence custodian, review cadence, legal and records duties and restoration rights. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Repair teams cannot approve their own trusted re-entry without independent evidence and decision-owner input. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: The HSM team restores configuration; the signing authority and reviewer decide whether signing may resume. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 3 check · what should survive an audit
- Define the decision unit for “Open authority, cryptographic and decision workstreams”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 4 OF 13 · Reconstruct chronology and scope
4. Build a chronology from trusted and operational time
Separate content creation, signature generation, trusted timestamp, queue entry, transport, first observation and verification. Account for clock sources, drift, log integrity and missing events.
Evidence record: Store time source, confidence, signed timestamp token, producer and HSM logs, queue IDs, transport receipts, client logs, clock offsets, gaps and alternate sequences. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Do not equate arrival, embedded time or log time with signing time unless the evidence model supports it. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A receipt arrives after cutover but a trusted timestamp and queue record prove pre-cutover signing. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 4 check · what should survive an audit
- Define the decision unit for “Build a chronology from trusted and operational time”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 5 OF 13 · Reconstruct chronology and scope
5. Distinguish delayed delivery, replay and new signing
Compare receipt and content digests, identifiers, timestamps, queue history, nonce or sequence controls, duplicate observations and producer state. Test whether identical or altered bytes appeared earlier.
Evidence record: Record comparison method, corpus searched, exact and semantic matches, identifiers, transport path, result, false-match limits and classification confidence. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Use “uncertain” when evidence cannot separate states; protect decisions while retaining all plausible explanations. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Two receipts share content but differ in signature and new trusted time; treat this as potential new signing, not replay. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 5 check · what should survive an audit
- Define the decision unit for “Distinguish delayed delivery, replay and new signing”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
Worked receipt chronology
| Observation | Plausible state | Immediate action | Proof needed |
|---|---|---|---|
| Old key, old timestamp | Delayed delivery | Preserve and trace | Queue evidence |
| Same bytes repeated | Replay | Block duplicate | Digest and transport |
| Old key, new trusted time | New signing | Stop signer | HSM and service logs |
| Ambiguous time | Uncertain authority | Hold decision | Independent reconstruction |
Classify only to the strongest evidence-supported state.
CHAPTER 6 OF 13 · Protect consumers, archives and decisions
6. Bound affected producers, receipts and consumers
Search every signer path, HSM cluster, batch job, disaster-recovery image, offline producer, partner integration and receipt store. Identify consumers that accepted, rejected or never saw affected receipts.
Evidence record: Maintain producer and consumer denominators, key and policy versions, last receipts, connectivity, logs, searches, unavailable systems, unknown classes and evidence confidence. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Unknown offline producers or consumers remain in scope; no search hit applies only to the searched systems and terms. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A disaster-recovery batch signer was not in the cutover inventory; quarantine its outputs until reconciled. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 6 check · what should survive an audit
- Define the decision unit for “Bound affected producers, receipts and consumers”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 7 OF 13 · Protect consumers, archives and decisions
7. Protect consumers through a versioned trust instruction
Distribute signed guidance defining affected key IDs, receipt identifiers, observation window, hold or rejection behaviour, continuity source and historical-validation boundary. Track acknowledgements and local policy.
Evidence record: Retain instruction version, signer, recipients, channels, activation, expiry, acknowledgements, failures, overrides, offline package and verification evidence. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Do not ask consumers to remove all historical trust or disable validation; use the narrowest policy that protects uncertain new receipts. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Online clients hold named receipts while archives continue verifying pre-cutover receipts under trusted-time rules. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 7 check · what should survive an audit
- Define the decision unit for “Protect consumers through a versioned trust instruction”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 8 OF 13 · Protect consumers, archives and decisions
8. Assess archive impact without retroactive overreach
Determine whether compromise, unauthorised use or policy drift affects signatures before, during or after a credible time boundary. Test archive validators with preserved status and timestamp evidence.
Evidence record: Store archive corpus, key lifecycle, trusted times, revocation reason and time, status objects, policies, validator versions, outcomes, uncertainty and affected collections. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Revocation reason matters; do not invalidate every historical signature automatically or preserve all blindly. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A compromised key requires policy-based review of pre-revocation receipts, while an authority error may have a narrower window. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 8 check · what should survive an audit
- Define the decision unit for “Assess archive impact without retroactive overreach”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 9 OF 13 · Revoke, repair and independently test
9. Recall and repair affected decisions
Trace uncertain receipts into approvals, rankings, releases, overrides and downstream actions. Distinguish receipt exposure, reliance and changed outcome; preserve original and corrected chronology.
Evidence record: Link receipt, consumer, access, decision, rule, competing evidence, authority, consequence, remedy, notification, recipient receipt and appeal route. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Hold high-consequence decisions first; no-action conclusions require reproducible evidence, not an unchanged final result alone. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A receipt was viewed but the decision relied on an independently verified source; document exposure without inventing outcome change. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 9 check · what should survive an audit
- Define the decision unit for “Recall and repair affected decisions”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
Trusted re-entry gate
| Gate | Pass evidence | Remain contained when |
|---|---|---|
| Signer | Active key enforced | Old slot reachable |
| Consumer | New policy verified | Unknown offline class |
| Archive | Historical corpus passes | Validation regression |
| Response | Revocation exercised | Authority gap |
A repaired signer does not by itself repair affected decisions or archives.
CHAPTER 10 OF 13 · Revoke, repair and independently test
10. Execute emergency revocation and status publication deliberately
If authority and evidence support revocation, send the request, publish CRL or OCSP status, stop key use, notify relying parties and preserve status artefacts. Account for caches and offline consumers.
Evidence record: Retain request, authority, reason, time, certificate, status publications, propagation, cache behaviour, notifications, acknowledgements, exceptions and continuity plan. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Do not delay a necessary compromise revocation for perfect scope, but keep uncertainty and historical policy explicit. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Revoke the compromised certificate, then verify online and offline consumers observe the status within declared windows. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 10 check · what should survive an audit
- Define the decision unit for “Execute emergency revocation and status publication deliberately”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 11 OF 13 · Revoke, repair and independently test
11. Repair signer paths and remove hidden old-key access
Inspect HSM slots, aliases, environment variables, deployment secrets, failover configuration, schedulers, disaster recovery, backups and emergency scripts. Enforce active-key selection and evidence-rich failure.
Evidence record: Store configuration versions, key inventory, access logs, code and job changes, blocked attempts, secrets rotation, tests, residual access and owner. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: A UI label or deleted alias is not proof; attempt a controlled old-key selection and require visible rejection. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Restart a failover signer with the retired alias and confirm it refuses to sign. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 11 check · what should survive an audit
- Define the decision unit for “Repair signer paths and remove hidden old-key access”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 12 OF 13 · Restore trusted signing and learn
12. Run independent changed-context trust tests
Use fixtures spanning active and retired keys, delayed queues, replay, clock drift, expired certificates, revoked status, offline consumers and archives. Hide conditions from repair owners.
Evidence record: Record reviewer independence, corpus, scenario, expected outcome, producer and consumer results, timing, false results, misses, challenged policy, repair and retest. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: A successful normal receipt cannot validate incident recovery; tests must exercise the escaped path and alternatives. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Simulate a delayed delivery with old trusted time and a new signing attempt with new trusted time; require different outcomes. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 12 check · what should survive an audit
- Define the decision unit for “Run independent changed-context trust tests”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 13 OF 13 · Restore trusted signing and learn
13. Authorise trusted re-entry and retain surveillance
Restore named signers, consumers and receipt classes in stages. Publish active keys, policies, residual exceptions, monitoring, expiry and automatic containment triggers. Preserve incident evidence and lessons.
Evidence record: Retain authorised scope, passed gates, exclusions, key and policy versions, owners, next review, archive state, decision remedies, ordinary metrics and reopening conditions. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Any new old-key signing, unknown producer or validator regression automatically reopens heightened response. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Resume online signing first while a previously unknown offline partner remains contained. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 13 check · what should survive an audit
- Define the decision unit for “Authorise trusted re-entry and retain surveillance”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
Verification lab: work the decision twice
Preserve a fictional old-key receipt and construct separate signing, timestamp, queue, transport and observation times.
Classify three cases as delayed delivery, replay and possible new signing using digests, trusted time, producer logs and transport evidence.
Exercise revocation, consumer notification, archive validation, decision repair and staged re-entry with hidden changed-context fixtures.
Limits and misconceptions
Arrival time is not signing time
Use trusted timestamps, protected logs and queue evidence.
Revocation is not automatic historical invalidation
Apply reason, time and policy to archived signatures.
Containment is not key deletion
Preserve evidence and public material needed for history.
Signer repair is not decision repair
Trace affected receipts into real reliance and remedies.
Questions readers ask
Does any old-key receipt prove compromise?
- No; it may be delayed delivery, replay, drift or new signing, but it still requires evidence-preserving protection.
Should the old certificate be removed?
- Not reflexively; historical verification may need it while private-key use is contained.
When is revocation necessary?
- When authorised evidence supports compromise or invalid authority under the applicable key policy.
How are offline consumers protected?
- With signed, versioned instructions, bounded packages, acknowledgements and expiry.
What decisions need repair?
- Those that relied on receipts whose authority or integrity is no longer sufficiently supported.
When may signing resume?
- After bounded signer, consumer, archive and response gates pass independent changed-context tests.
Practise, verify and continue
Respond to an old-key receipt by preserving bytes, containing signers, building chronology, separating replay and delayed delivery, protecting consumers, exercising revocation and repairing one affected decision before staged re-entry.
Apply the method to signed policy bundles, model approvals or regulatory notices. Preserve authority, trusted time, historical evidence, consumer policy and decision chronology.
Practical evidence check
Before implementation, write a one-page evidence map with the decision, unit of analysis, version or time boundary, inputs, outcomes, uncertainty, authority and stop rule. Attach one worked case that passes and one that fails. A reviewer should be able to reproduce the reasoning without relying on the memory of the person who built the system.
Run one changed-context rehearsal before approval. Alter a mechanism rather than a cosmetic detail, then identify which calculation, safeguard or governance gate must change. Record any conclusion that does not transfer. This short rehearsal is often the fastest way to expose a hidden assumption before it becomes an operational dependency.
Related eduKate reading
OWA key-rotation post-cutover surveillance
OWA key rotation and trust continuity
OWA re-release surveillance
OWA release-discrepancy triage
Authoritative sources and scope
NIST SP 800-57 Part 1 Rev. 5 key-management guidance
NIST SP 800-61 Rev. 3 incident-response guidance
NIST SP 800-102 digital-signature timeliness
NIST PIV key management, CRL and OCSP requirements
NIST sources support key lifecycle, incident response, trusted time, revocation notification and certificate-status mechanisms. They do not define OWA receipts or this incident workflow. Algorithms, HSMs, certificates, authority, legal effect, records and privacy require actual system policy.