Summary
- Track key custody, certificate continuity, software maintenance and incident authority as public-service dependencies.
- Fund staff depth, rehearsed recovery and transparent governance before scale turns a small-team strength into concentration risk.
Through Let’s Encrypt, Prossimo and Divvi Up, Internet Security Research Group has made encryption, memory safety and privacy-preserving measurement deployable. That leverage is valuable because common infrastructure can raise a broad security floor. It also concentrates responsibility in a relatively small institution. The next useful evidence is tested succession across people, keys, systems and funding. Trust remains public when users can understand both the service and the organisation’s ability to survive disruption.
