TL;DR: Cloud sovereignty requirements are colliding with PKI modernization, because legacy certificate operations were built for static environments and often fail under hybrid, automated, audit-heavy conditions, according to Keyfactor. The governance problem is no longer whether PKI can move to cloud, but whether cryptographic control, residency, and lifecycle discipline can survive that move.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Keyfactor's blog post: Cloud sovereignty requirements change PKI governance, and modern PKI can preserve cryptographic control, residency, and auditability in cloud and hybrid environments.
Why it matters: It matters because PKI, IAM, and cloud security teams need governance models that preserve control over certificates, keys, and trust boundaries while still supporting automation and compliance.
Context
Cloud sovereignty in PKI means keeping cryptographic keys, certificate authorities, and related operational control inside the legal and operational boundaries that matter to the organisation. The article argues that the historical trade-off between cloud adoption and cryptographic control is increasingly outdated, but only when governance is designed for modern deployment models.
For IAM, IGA, and security architecture teams, the issue is not simply where PKI runs. It is whether certificate lifecycle management, audit evidence, and policy enforcement still work when the environment spans on-premises systems, private cloud, public cloud, and sovereign cloud regions.
Key questions
Q: How should security teams govern PKI across cloud and on-premise systems?
A: Security teams should govern PKI as part of the wider identity estate, not as a standalone crypto service. That means assigning owners, tracking issuance sources, monitoring renewal windows, and validating revocation paths across every environment where certificates are used. The goal is to keep certificate trust aligned with business accountability and deployment reality.
Q: Why do traditional PKI models struggle with cloud sovereignty?
A: Because they were built for static environments and manual control paths. Cloud sovereignty demands automated issuance, renewal, revocation, and auditability across distributed environments, which exposes certificate sprawl and inconsistent governance when older PKI processes are moved without redesign.
Q: What breaks when certificate lifecycle management is still manual?
A: Manual certificate management breaks at the point where expiry, ownership, and renewal do not line up. Services fail when a certificate expires, teams lose visibility when ownership is fragmented, and outage response becomes reactive instead of governed. The result is avoidable downtime, repeated exceptions, and an estate that grows faster than the people managing it.
Q: How do zero trust and cloud sovereignty change PKI accountability?
A: They push accountability toward provable control over trust assets, not just platform availability. Teams must be able to show who manages keys, how access to certificate infrastructure is restricted, and how policy enforcement remains intact as environments change.
Technical breakdown
Why legacy PKI breaks under cloud sovereignty requirements
Legacy PKI was usually designed for static infrastructure, manual workflows, and clear organisational boundaries. In cloud environments, certificate issuance, renewal, and revocation have to keep pace with DevOps pipelines, multi-region deployment, and audit expectations that cross business units and jurisdictions. When those controls remain manual or fragmented, certificate sprawl and inconsistent policy enforcement follow. Sovereignty adds another constraint because control over keys, CA hierarchies, and residency cannot be delegated away without changing the trust model.
Practical implication: Map every certificate lifecycle step to an owner, an environment, and a policy control before moving PKI into sovereign cloud models.
How audit-ready PKI supports residency and cryptographic control
Audit-ready PKI is not just about logging. It requires provable control over where keys live, who can operate certificate authorities, and how policy decisions are enforced across jurisdictions. The article links this to zero trust expectations and to regulatory pressure around data privacy and cryptographic control. In practice, that means the PKI stack must support transparent operations, bounded administrative access, and evidence that cryptographic assets remain within approved regional or organisational boundaries.
Practical implication: Treat residency, administrative access, and lifecycle evidence as part of PKI design rather than as post-deployment compliance checks.
Why automation changes certificate governance, not just efficiency
Automation in PKI is not merely an operational convenience. When issuance, renewal, and revocation are API-driven, governance shifts from ticket-based control to policy-based control. That matters in cloud sovereignty contexts because short-lived certificates, DevOps integration, and fast recovery all depend on machine-speed lifecycle management. The governance challenge is to automate without creating black-box operations or shared tenancy that weaken the sovereignty and trust guarantees the programme is meant to preserve.
Practical implication: Use automation to enforce policy consistency and certificate hygiene, but keep operator authority and audit visibility explicit.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Sovereign PKI is now a governance design problem, not a deployment-location question. The article shows that cloud residency by itself does not solve cryptographic control, because keys, CA operations, and audit evidence still need explicit governance. That shifts the conversation from where PKI runs to who controls it, how it is evidenced, and whether policy survives jurisdictional boundaries. Practitioners should evaluate PKI as a governance plane, not a hosting choice.
Legacy certificate operations create sovereignty debt. Traditional PKI models were built for static estates and manual change control, which makes them brittle in cloud-native environments with frequent provisioning and policy change. The result is not just inefficiency. It is a control gap where certificate sprawl, inconsistent revocation, and weak visibility erode both compliance and trust. Practitioners need to treat those operational residues as governance risk, not technical noise.
Zero trust and cloud sovereignty now intersect at certificate lifecycle discipline. The article correctly ties sovereignty requirements to zero trust expectations because both depend on continuous policy enforcement and auditable trust decisions. A PKI programme that cannot automate issuance, renewal, and revocation across environments cannot support either goal reliably. The practical takeaway is that certificate lifecycle control has become part of access governance, not a back-office utility.
Cryptographic control boundaries are becoming a distinct identity governance concept. Cloud sovereignty pushes identity teams to define where trust anchors are allowed to exist and who can operate them across regions and clouds. That is a different governance question from simple workload access or perimeter security. The concept to watch is cryptographic control boundary, because it captures the new requirement to align residency, operator privilege, and certificate authority governance in one model.
PKI modernisation is increasingly an audit-readiness issue for regulated cloud adoption. Organisations that cannot prove policy enforcement across key management, certificates, and administrative access will struggle to satisfy both sovereignty commitments and compliance reviews. The governance burden is no longer just technical uptime. It is demonstrating that trust assets remain controllable under modern deployment patterns. Practitioners should expect PKI review to move closer to board-level risk and regulatory oversight.
From our research library:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- Read next: Machine Identity, PKI and Certificate Lifecycle Guide
What this signals
Cryptographic control boundary: sovereignty programmes now have to define the legal, operational, and administrative boundary around keys and certificate authorities. That boundary becomes a governance object in its own right, because cloud residency without operator control is not sovereignty in practice.
For practitioners, the immediate test is whether PKI workflows can survive migration without losing audit evidence or policy consistency. If certificate issuance, renewal, and revocation still depend on manual exception handling, the cloud model has imported legacy fragility instead of reducing it.
For practitioners
- Map cryptographic control boundaries Define where keys, certificate authorities, and policy decisions are allowed to reside, and document which jurisdictions and cloud regions are in scope for each trust domain.
- Automate certificate lifecycle workflows Replace ticket-based issuance, renewal, and revocation with policy-driven workflows that can operate consistently across cloud, private cloud, and on-premises environments.
- Separate operator access from trust policy Ensure administrators can operate the PKI platform without being able to alter sovereignty policy, residency assumptions, or certificate governance without review.
- Evidence audit readiness by design Keep logs, ownership records, and lifecycle traces that prove where cryptographic assets are managed and how controls are enforced across regions.
Key takeaways
- Cloud sovereignty changes PKI from a deployment concern into a governance discipline focused on control, residency, and auditability.
- The main risk is certificate sprawl and brittle lifecycle management when legacy PKI is moved into hybrid and cloud-native environments without redesign.
- Practitioners need automated lifecycle controls, explicit operator boundaries, and auditable trust evidence to preserve sovereignty in modern PKI.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-57, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the technical controls, while PCI DSS v4.0 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-57 | Part 1 — Key Management Lifecycle | The article centers on control of keys, CA operations, and lifecycle discipline in sovereign cloud PKI. |
| Recommendation — Apply key lifecycle governance to preserve control over cryptographic assets across cloud and regional boundaries. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article stresses restricted administrative control over PKI operations and trust assets. |
| Recommendation — Restrict PKI administrative entitlements so residency and policy decisions remain under explicit governance. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture — Zero Trust Architecture | The article links sovereign PKI to zero trust principles and continuous trust enforcement. |
| Recommendation — Align PKI lifecycle controls with zero trust principles so trust decisions stay continuously verifiable. | ||
| PCI DSS v4.0 | Requirement 4 — Encrypt transmission of cardholder data across open, public networks | The article notes PCI DSS as part of OVHcloud's compliance context in sovereign cloud operations. |
| Recommendation — Use PCI DSS evidence requirements to validate cryptographic control in sovereign hosting models. | ||
Key terms
- Cloud Sovereignty: Cloud sovereignty is the ability to keep data, cryptographic assets, and operational control within the legal and organisational boundaries an enterprise requires. In PKI, that means key custody, certificate authority operations, and administration must remain governable even when infrastructure spans cloud regions or deployment models.
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Cryptographic Access Boundary: A cryptographic access boundary is the point at which access is controlled by keys, encryption, or secret-sharing rather than simple directory membership. In these systems, automation must respect decryption rights and key custody, because a normal group update can have security consequences beyond administration.
- Audit-Ready PKI: Audit-ready PKI is a certificate and key management model that can produce clear evidence of ownership, policy enforcement, and lifecycle actions on demand. It is less about logging volume and more about proving control over trust assets across changing environments and jurisdictions.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 25, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org