Recover the authority and drain old trust

A single stolen workload credential may permit subject-level disablement and credential replacement. A compromised intermediate or signing service can affect many subjects and may mint new documents, requiring verifier trust changes and a trusted replacement issuer. A compromised root or bootstrap channel changes how replacements themselves can be authenticated. Identify an independent recovery authority or provisioning path rather than asking the suspected authority to prove that its successor is safe. Preserve audit evidence without exposing reusable keys.

Stop unauthorized issuance and enrollment, constrain affected resource access, and inventory where old trust material is cached. Include agents, service meshes, token verifiers, federated peers, gateways, and offline jobs. A rolling deployment can leave forgotten workers accepting the old authority. Emergency changes also need availability planning: abruptly removing every root can isolate healthy services before they receive replacements. Use a staged plan with explicit security cutoffs and observed enforcement, rather than an indefinite overlap that quietly preserves compromised trust.

Distribution of new roots and credentials can overlap during ordinary rotation, while compromise recovery may require a faster distrust deadline. Record when each verifier stops accepting the old root, when cached keys expire or are invalidated, and whether derived local tokens remain valid. TLS tickets and established channels are separate paths: replacement of a certificate does not necessarily discard them. A transport KeyUpdate refreshes traffic keys within a connection rather than authenticating a new workload identity.

A finite drain argument needs a last possible old authentication time, including resumed authentication and delayed acceptance paths, followed by a bounded lifetime for every resulting session. If tickets can be renewed indefinitely or a connection has no enforced lifetime and no reauthorization, no finite drain deadline follows from root distribution alone. Do not add guessed average durations to a worst-case proof. Apply hard cutoffs, verify their scope, and test old credentials, tickets, and long-running connections deliberately.

Verify that replacement identities can enroll, renew, authenticate, and perform only their intended actions. Test rejection with representative old leaf credentials, old issuer chains, stale cached keys, and preserved tickets after the cutoff. Inspect active-session inventories and application authorization, not just control-plane health. Reconcile federation peers and out-of-band consumers that may not receive automatic updates. A restored issuer with no functioning workloads is incomplete recovery; healthy workloads still accepting compromised identity state are also incomplete.

The reliability lab illustrates only replica reachability. Reset and set both n=5, k=2, predict three available and majority three; Reset and re-set n=5, k=3, predict two available. It models no key compromise, trust roots, issuance, or sessions. An available majority does not prove the recovered authority is trustworthy or old sessions are drained. Use the contrast to list the independent authentication, authorization, rotation, and rejection evidence required alongside service availability.