Two CAs, One Mesh: How FrameWorks Services Get Their Identity
Navigator runs an internal CA for service-to-service traffic and drives ACME for public endpoints; Privateer distributes keys and WireGuard config to every node. Why a sovereign platform has to own its own trust root.