How Observability, Short-Lived Credentials, and Enforcement Saved the Web's Certificate Trust Model

This article examines how the web's Certificate Authority (CA) trust model has survived over a decade of security breaches, misissued certificates, and distrust events. It argues that three key mechanisms — observability (Certificate Transparency), short-lived credentials, and active enforcement (tools like CRLSets and OneCRL) — have held the system together despite repeated CA failures. The piece traces the original PKI design assumptions, documents major CA incidents (DigiNotar, Comodo, Symantec, Let's Encrypt), and explores whether these same levers will be sufficient for emerging challenges like quantum computing, AI-generated certificates, and post-quantum cryptography transitions. It positions the CA trust model as a case study in delegated trust that applies broadly to any system where trust is outsourced.