We use different central authorities than certificates, which manage keys directly; the end result is much the same even if the tools are theoretically inferior

We use different central authorities than certificates, which manage keys directly; the end result is much the same even if the tools are theoretically inferior. Long-lived keys on laptops might be a weakness at this point, honestly. I expect that to be resolved by a slow but steady move to "whatever the cloud supports" as AWS and such rolls out their various solutions. I know we've got teams that use them, I imagine it'll be obligatory at some point here. I know it's not perfect, which is why I contrasted "polished turd" to the "uncut diamond in the rough". We're at a size where it's really hard to justify a whole lot of work on the uncut diamond, in contrast with the various cloud efforts to fix their problems. Given that such things now exist it's more a matter of moving over to them than developing anything ourselves now, which is probably an improvement over where we were two years ago. We probably couldn't have beaten the clouds even if we did put the effort in; this is in that class of problem where the effort is nominally small but the price of not breaking things is so large than it ends up a multi-year project anyhow. (One of my least favorite classes of project.) I'd also add that I report this not in the spirit of "we've solved this problem", but just an experience report.