I found this really useful. It's lightweight, simple and powerful. However, some pieces of advice in the article could prove catastrophic: "You need to distri

I found this really useful. It's lightweight, simple and powerful. However, some pieces of advice in the article could prove catastrophic: "You need to distribute ca.pub to your entire fleet. Remember, this is meant to be public, so complete access lockdown isn't the goal." Complete access lockdown is vital. You need to prevent the CA's public key from being altered, corrupted or deleted across your fleet. When distributing the CA's public key, you definitely need to use a secure transport. The CA's public key is what your system of trust is built on. You need to make sure you are trusting the right thing. "Copy the latter to the CA server and get it signed. Because this is public information, the transport isn't important. You can copy and paste, or fax it" When copying the user's public key to the server, the transport is still important, otherwise a MITM could swap the public key and your CA would happily sign the wrong thing.