In the client-side cryptography layer, a trusted keypair is able to sign a new public key, allowing that new key to be trusted by others in organization--this d

In the client-side cryptography layer, a trusted keypair is able to sign a new public key, allowing that new key to be trusted by others in organization--this delegation of signing authority is what makes it a web of trust rather than a PKI. Importantly, this is also restricted by the API server in the authorization layer. To invite a new user to an organization, authorize a device, or generate a new ENVKEY for an environment, a user must have appropriate permissions in the organization. The trusted root is passed along, signed, through the invitation flow or ENVKEY generation, so that all keypairs in the organization agree on the trusted root of the organization, and can verify signature chains back to that root in order to trust a public key. Initially, the trusted root will be the keypair associated with the device that created the organization, but it can be revoked and replaced by another trusted keypair (again, given appropriate API permissions).