Administer

Trust & keys

Custody

Signer not yet wired
Node identity
TPM-backed device certificate — CTRL-XG-01 root of trust
Controller signing key
site-controller-key-01 (HSM-backed, site-local)

Key inventory

Audit checkpoint signingSite controller (GW-01)HSM-backed, site-local, never leaves the controller2026-10-19
Backup encryptionSite controller (GW-01)TPM-sealed, site-local2026-09-30
OTA capsule verificationSmartRack vendor release engineeringVendor-held; public key pinned on every gateway2027-01-01
Break-glass shard (A)BGC-01 — Varga ZoltánCustodian-held physical shard; no escrow2026-08-12
Break-glass shard (B)BGC-02 — Szabó LászlóCustodian-held physical shard; no escrow2026-08-12

Rotation history

  1. break-glass-shard-a / break-glass-shard-b
    Automatic post-use rotation after ceremony BG-2026-05-12 (75 min after ceremony start)
  2. site-controller-key-01
    Routine 180-day rotation, pre-pilot baseline
  3. backup-encryption-key-01
    Routine 180-day rotation

Break-glass custodians

BGC-01 — Shard A (site admin) 24/7 reachable
Name
Varga Zoltán
Last drill
12 May 2026, 12:00
BGC-02 — Shard B (operations) 24/7 reachable
Name
Szabó László
Last drill
12 May 2026, 12:00

Ceremony walkthrough

A break-glass request is raised with a reason and a named witness — no anonymous requests.

Ceremony record

  1. BG-2026-05-12 · Completed
    Witnessed drill: recover admin access with identity provider unavailable (no live incident) — 34 min, witnessed by Bencze Ádám (ARIS support)