PKI is becoming the trust layer for digital government identity

At a glance

What this is: This article argues that PKI is the trust layer underpinning digital government, linking identity verification, encryption, and audit trails to citizen services and machine identity.

Why it matters: It matters because IAM, IGA, PAM, and NHI teams increasingly have to govern certificate-based trust across people, systems, and connected devices, not just passwords and MFA.

By the numbers:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.

👉 Read eMudhra's article on PKI services for digital government trust

Context

PKI, or public key infrastructure, is the certificate and trust system that lets one party verify another, encrypt communication, and prove that a digital action has not been altered. In the context of digital government, it becomes part of the identity plane, because every portal login, e-signature, and machine-to-machine exchange depends on trusted cryptographic identities.

The article’s central claim is that digital governance now rests on measurable trust, not just access control. That puts certificate lifecycle management, issuer governance, and machine identity oversight into the same operational conversation as IAM, IGA, and NHI controls.

The article also treats machine identity as a first-class requirement, which is directionally correct for modern public-sector platforms. That makes the PKI discussion relevant not only to citizens, but also to devices, services, and connected systems that need cryptographic trust to participate safely in government workflows.

Key questions

Q: How should organisations govern reusable digital identity across multiple services?

A: Treat reusable digital identity as a governed trust decision, not a convenience feature. Set assurance thresholds for the original proofing event, define which relying parties can accept reuse, and require revocation and monitoring rules that match the risk of the transaction. Without those controls, reuse spreads a weak trust decision instead of reducing friction.

Q: Why do PKI failures create identity risk as well as encryption risk?

A: PKI failures create identity risk because a certificate is a credential that proves who or what a system believes it is. If identity proofing is weak, revocation is delayed, or certificate ownership is unclear, attackers can impersonate legitimate users, services, or organisations while still appearing trusted to downstream systems.

Q: What do security teams get wrong about machine identities in PKI programmes?

A: Teams often focus on issuance and forget the lifecycle. Machine identities require the same ownership, rotation, and offboarding discipline as any other non-human identity. If a device or service can still authenticate after it should have been retired, the trust model has already failed.

Q: Who should be accountable when certificate abuse leads to domain compromise?

A: Accountability should sit with the teams that govern identity trust, template policy, and privileged enrolment, not only with Windows administrators. AD CS compromise is an identity governance failure because it converts a certificate decision into domain-level authority.

Technical breakdown

How PKI certificates establish identity trust in digital services

A PKI certificate binds an identity to a public key and relies on a certificate authority to vouch for that binding. In practice, that lets a government portal, API, or signing workflow verify who or what is connecting before any sensitive exchange takes place. The important distinction is that PKI does not authenticate by shared secret alone. It creates cryptographic proof that can be checked independently, which is why it supports e-signatures, encrypted channels, and auditability in high-trust workflows.

Practical implication: Treat certificate issuance and revocation as core identity controls, not as back-end encryption tasks.

Why certificate lifecycle management is the real control plane

PKI only works when issuance, renewal, rotation, revocation, and expiry are governed consistently. A valid certificate is a live identity credential, and a stale one can continue to authenticate long after the business relationship, device state, or service need has changed. That makes lifecycle governance the operational control plane for digital trust. In public-sector environments, the risk is not just compromise. It is trust persistence, where an identity remains usable after the conditions that justified it no longer exist.

Practical implication: Map every certificate to an owner, an expiry condition, and a revocation path before it is allowed into production.

Machine identity management for IoT and cross-border exchanges

The article’s mention of IoT devices and cross-border interoperability reflects a broader reality: PKI is often governing non-human identities, not just people. Devices, workloads, and services use certificates to establish trust with other systems, often at high volume and across organisational boundaries. That creates a governance problem familiar to NHI programmes, including inventory gaps, renewal failures, and unclear accountability. When machine identities scale faster than human review cycles, certificate trust becomes an NHI issue whether teams label it that way or not.

Practical implication: Extend NHI inventory, ownership, and lifecycle controls to every certificate-backed device and service.

Threat narrative

Attacker objective: The attacker aims to impersonate a trusted digital identity well enough to access services, alter records, or commit fraud without triggering ordinary authentication controls.

1. Entry occurs when an attacker can impersonate a legitimate user, portal, or device by exploiting weak trust in the digital identity layer. If certificate governance is poor, a forged or stolen identity can appear legitimate to downstream services.
2. Escalation follows when the attacker abuses that trust to sign transactions, access administrative portals, or move through service-to-service connections that accept certificate-backed authentication without strong lifecycle validation.
3. Impact comes from fraudulent enrollment, data theft, manipulated records, or unauthorized government service access at scale, because the cryptographic trust layer is treated as proof of legitimacy even after its assurance has expired.

Breaches seen in the wild

• Sisense breach — unauthorized GitLab access led to exfiltration of access tokens, API keys and certificates.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

PKI is not just encryption infrastructure, it is identity governance for cryptographic actors. Governments often describe certificates as technical plumbing, but the article shows they now function as the trust backbone for citizen access, device access, and service-to-service exchange. That makes certificate ownership, issuance policy, and revocation discipline part of identity governance, not separate from it. The practitioner implication is that certificate trust should be governed with the same rigour as privileged access.

Certificate lifecycle control is the hidden failure point in digital trust programmes. The article focuses on sovereignty and verification, but both collapse if renewal, expiry, and revocation are not operationally enforced. A certificate that outlives its intended use behaves like standing privilege in cryptographic form. The implication is not merely to issue certificates more carefully, but to treat lifecycle failure as a governance defect.

Machine identity management is now inseparable from public-sector PKI strategy. The article’s references to IoT and cross-border interoperability show that governments are already governing non-human identities at scale, whether or not the programme is named as NHI. That broadens the identity perimeter beyond human users and into devices, workloads, and signing systems. Practitioners should align PKI governance with NHI inventory, ownership, and offboarding controls.

Trusted digital identity becomes a national-scale control surface when data sovereignty matters. The article frames local control over keys and identity attributes as a public confidence issue, which is accurate from an identity-security perspective. If trust anchors, certificate authorities, and audit trails are not under clear governance, sovereignty claims become difficult to operationalise. The practitioner conclusion is that cryptographic trust architecture must be governed as critical infrastructure.

PKI governance should be measured by revocation certainty, not certificate volume. Large certificate estates can look healthy while quietly accumulating stale, orphaned, or unmanaged identities. The decisive question is how quickly the organisation can invalidate trust when a credential, device, or relationship changes. The implication is to measure trust removal speed as a first-class security outcome.

From our research:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
• Only 5.7% of organisations have full visibility into their service accounts, which shows how quickly identity inventory breaks down at machine scale.
• That visibility gap is why teams should also use 52 NHI Breaches Analysis to study how unmanaged identities turn into real incidents.

What this signals

PKI programmes are moving into the same governance category as NHI inventories. Once certificates are used for citizen portals, devices, and signing workflows, the operational question becomes who owns the trust artefact and how quickly it can be removed. Teams should align certificate governance with the lifecycle patterns in Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.

The practical signal is that digital sovereignty cannot be asserted without evidence of control over issuance, revocation, and key custody. That is a governance problem as much as a cryptographic one, and it belongs in identity programme reporting rather than being left to infrastructure teams alone.

Identity blast radius: when a certificate authority, signing system, or trust anchor is weakly governed, the impact is rarely local. Use the 52 NHI Breaches Analysis to frame the downstream consequences of stale or over-privileged non-human credentials.

For practitioners

• Map every certificate to a named business owner Require an accountable owner, issuing authority, and revocation path for each certificate, including certificates used by ministries, devices, and automated services. Ownership should be tied to a lifecycle record so renewal and offboarding are not left to ad hoc administration.
• Build certificate lifecycle controls into identity governance Treat issuance, renewal, expiry, and revocation as governed identity events rather than infrastructure maintenance. Link certificate records to access reviews, service ownership, and change management so stale trust is visible before it becomes an incident.
• Extend NHI inventory to machine certificates Include IoT devices, service accounts, integration certificates, and signing identities in the same inventory model. Use the Ultimate Guide to NHIs to anchor ownership, visibility, rotation, and offboarding expectations for cryptographic identities.
• Validate revocation paths before scaling trust Test that revocation is actually enforced by relying systems, not just recorded in a certificate authority. A certificate that is revoked on paper but still accepted by downstream applications is a broken control, not a completed action.

Key takeaways

• PKI has become an identity governance control, not just an encryption layer, because it now underpins citizen access, device trust, and auditability.
• The real risk is lifecycle failure: certificates that stay valid after their business purpose has ended behave like standing privilege in cryptographic form.
• Security teams should govern certificate-backed identities with the same inventory, ownership, and offboarding discipline they apply to other NHIs.

Key terms

• Public Key Infrastructure: Public Key Infrastructure is the trust system that issues, manages, and revokes digital certificates used to prove identity. In practice it binds keys to entities and policies, making authentication, encryption, and non-repudiation possible across users, devices, and services.
• Certificate lifecycle management: Certificate lifecycle management is the governance of issuance, renewal, rotation, expiry, and revocation for digital certificates. In practice, it is the control plane that determines whether trust remains valid only as long as the underlying identity, device, or service genuinely needs it.
• Machine identity: Machine identity is the cryptographic identity assigned to a non-human actor such as a device, workload, service, or integration. It is often certificate-backed and must be governed like any other identity, including ownership, visibility, and offboarding when the asset or relationship changes.
• Digital trust: Digital trust is the confidence that a system, identity, or transaction is genuine, intact, and authorised. In modern governance environments, it depends on certificates, identity proofing, access controls, and audit trails working together, especially where people, services, and devices all interact.

What's in the full article

eMudhra's full article covers the operational detail this post intentionally leaves for the source:

• How its PKI services are positioned across government digital IDs, e-signatures, and national trust frameworks.
• The specific SecurePass IAM capabilities mentioned for identity governance, PAM, directory control, and certificate management.
• How the PKI platform is described for machine and IoT identity management in public-sector environments.
• The article's own framing of data sovereignty, local certificate authorities, and cross-border trust interoperability.

👉 The full eMudhra article covers national PKI, machine identity, and sovereignty-driven trust design.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.