Glossary
Trust Root
Every system that verifies identity or authority has to start trusting something without being able to verify it further — a root certificate, a root key, or a small set of people with irrevocable administrative power. That starting point is the trust root. Everything else in the system — every certificate it issues, every permission it grants — inherits its legitimacy from that root, directly or through a chain.
Because the trust root cannot itself be verified by the system it anchors, its protection has to come from outside the normal authorization flow: physical security, split custody among multiple people, hardware that resists extraction, and a change process that requires more than one person to act. A system that lets a single administrator silently rotate the trust root has, in an important sense, no trust root at all — it has a single point of compromise wearing a stronger name.