For havenco.com we are thinking that a cooperating group of privacy-concerned service operators could audit each others' assertions. The specific concern is th

For havenco.com we are thinking that a cooperating group of privacy-concerned service operators could audit each others' assertions. The specific concern is that it's really untested whether one could be compelled legally to keep updating warrant canaries. However, external auditing if it can be done without compromising the security or privacy of the systems at hand could give an extra level of certainty that the provider is trustworthy the claims that they are certifying. For modern devops-y infrastructure deployed from repositories of code and configs, it should be doable to have some level of auditing that the infrastructure as deployed represents the desired config state. That is how Akamai, for example, ran/runs its ESSL network - auditing that the deployed machines are per config, no local disk logging or core dumping, auditing before keys are deployed to let machines come into the system. Yes, there are also cameras and intrusion detection on the cabinets but it's really the software layer that provides the security. And now with chef, puppet, salf, cfengine, etc it is probably possible to build something to bring this level of auditing to almost any modern web service.