Context
Milestone 2c (decentralized discovery, spec docs/superpowers/specs/2026-07-06-decentralized-discovery-design.md) uses an offline single CA to sign membership certs + the root set. During brainstorming the user chose the offline-CA model for 2c and asked to backlog the stronger alternative for later research (no priority, after the rest of the roadmap).
Idea
Replace the single offline CA with a decentralized threshold CA: membership signing split across N roots via threshold signatures (t-of-n must co-sign to issue a member cert). No single root (or offline key) can forge membership, and no offline signing step is required — a node could enroll by collecting t partial signatures from the roots online.
Why deferred
Materially more complex than the offline CA: threshold Ed25519 (e.g. FROST) or a BLS threshold scheme, a multi-root enrollment protocol, key-resharing on root membership change. Over-scope for 2c's first cut; the offline CA already delivers "online-node compromise cannot forge membership."
When to revisit
After sub-project #2 (2a/2b/2c) and the higher-priority roadmap items (#9 rekey/PQ, #3 anti-DPI, #10 multi-core, #34 anti-replay) are done. Research-only for now.
Context
Milestone 2c (decentralized discovery, spec
docs/superpowers/specs/2026-07-06-decentralized-discovery-design.md) uses an offline single CA to sign membership certs + the root set. During brainstorming the user chose the offline-CA model for 2c and asked to backlog the stronger alternative for later research (no priority, after the rest of the roadmap).Idea
Replace the single offline CA with a decentralized threshold CA: membership signing split across N roots via threshold signatures (t-of-n must co-sign to issue a member cert). No single root (or offline key) can forge membership, and no offline signing step is required — a node could enroll by collecting t partial signatures from the roots online.
Why deferred
Materially more complex than the offline CA: threshold Ed25519 (e.g. FROST) or a BLS threshold scheme, a multi-root enrollment protocol, key-resharing on root membership change. Over-scope for 2c's first cut; the offline CA already delivers "online-node compromise cannot forge membership."
When to revisit
After sub-project #2 (2a/2b/2c) and the higher-priority roadmap items (#9 rekey/PQ, #3 anti-DPI, #10 multi-core, #34 anti-replay) are done. Research-only for now.