Trust-Anchor Honesty

Protocol and operations

The protocol operates independently for each kernel. Trust establishment is bilateral, key pinning is per-peer, revocation propagates via gossip. There is no master key, no validator election, no quorum threshold for routine action.

Every kernel still has to answer the operational question: “which kernel public keys do I accept handshakes from in the first place?” The answer is outside the protocol. Common options include common options include an industry consortium roster (an ISAC-equivalent for the relevant sector); an out-of-band PKI (a CA regardless of what it is called); operator-mediated key exchange (does not scale past dozens of peers); or a sector regulator publishing the canonical roster (likely outcome for finance and healthcare).

Sectoring: who issues the roster

Operational trust-anchor cost varies by sector and drives go-to-market sequencing. The table below is the docs team’s own go-to-market analysis, not a protocol record. Each row names the roster issuer that is closest to existing today, the bootstrap path an early adopter would take, the ceiling on organic peer count before that path breaks, and the primary risk against the Chio framing.

Migration is a renewable contract

A participant declares its accepted bootstrap roots in its passport. The relevant property is set-valued: a passport may declare accepted_bootstrap_roots = [SWIFT_PKI_root, DirectTrust_root] and a peer accepts the passport if at least one root is also accepted on the peer’s side. Migrations from one anchor to another are not a fork; they are an additive change at the next anchor epoch.

Worked example: a mid-market vendor runs operator-mediated key exchange against three buyer counterparties. The buyers later coordinate around a sectoral consortium that publishes a signed roster. The vendor onboards once, then issues a passport revision whose accepted_bootstrap_roots adds the consortium root alongside the existing operator-pinned keys. A peer that still relies on operator-mediated trust sees no change: the original pinned key is still in the set. A peer that prefers the consortium root sees a passport whose root set now intersects its own. The handshake completes either way; the kernel does not have to know which root each side honoured.

What the peer sees during the swap, in order: the new passport with an extended root set arrives over gossip; the local kernel verifies that the new passport is signed by the previous passport’s kernel key (continuity); the local kernel checks intersection with its own accepted roots and finds the intersection unchanged or widened; the next handshake under the new passport completes with no operator action required. No replay, no manual reconciliation, no global roster reconciliation step. The Chio protocol does not federate roster issuers itself: it only requires that two participants share at least one accepted root.

Making the swap visible

At handshake time, a peer verifies each passport, including which bootstrap roots it declares as accepted. Trust-anchor migrations (a sector moving from operator-mediated exchange to a published roster, or adding a second roster alongside an existing one) are visible to every peer that verifies the passport. The protocol does not reconcile roster issuers. Two participants need at least one accepted root in common.

Sequencing implications

The sector table above sorts naturally into three tiers, and the sequencing decision falls out of that sort.

• Tier 1 leads. Banks (interbank) via SWIFT PKI and federal government via FPKI are the two cleanest anchors in production today. The work is a binding profile, not new infrastructure: a Chio kernel key bound to a BIC, or pinned under FPKI, ships in 1-3 months. These are the go-to-market beachheads because the bootstrap cost is near zero and the destination policy work is the only real path-finding.
• Tier 2 follows on the consortium pitch. Non-bank financial services via FS-ISAC, healthcare clinical scenarios via H-ISAC, electric utilities via E-ISAC, vehicle OEMs via Auto-ISAC, and aviation via Aviation-ISAC all have a credible roster issuer with no published roster yet. The second-wave SOC-consortium pitch depends on these ISACs treating “publish a signed kernel-key roster” as an explicit data type alongside their existing membership service. Fixed cost per ISAC is under $500K; marginal cost per member is negligible. The pitch is not “build a Chio consortium”; it is “extend your existing membership service.”
• Tier 3 waits. Gas and water utilities, freight carriers, the non-mobile slice of telecommunications, maritime, and state / local / tribal government all lack both production PKI and a sectoral roster issuer with the funding to act as one. In these sectors the Chio protocol design must keep operator-mediated exchange explicit because it is the viable bootstrap for the next several years.

The second-wave SOC-consortium pitch lives or dies on Tier 2 execution. If the named ISACs publish signed rosters on a defined roadmap, Tier 3 sectors can opt in as their own anchors mature; if they do not, Tier 3 stays a permanent backwater and the cross-vendor network effect never lights up.