Summary

  • SeCIU renewed .uy’s cryptographic hardware and DNSSEC keys at a 15 October ceremony. NIC.UY says the university’s legal directorate certified the procedure and representatives of seven organizations attended as witnesses.
  • ICANN describes its own role as technical witness. IANA still identifies SeCIU as the .uy manager. The new keys include material for an algorithm SeCIU plans to introduce in coming months; the public notices give no activation date.

A row of witnesses can make a key ceremony look like a council of owners. The .uy ceremony had representatives of ICANN, LACNIC, Antel, Agesic, ISOC Uruguay, the local engineering faculty and Universidad de Chile. Yet the hand on the controls belonged to SeCIU, the Universidad de la República unit that operates Uruguay’s country-code domain.

On 15 October, SeCIU replaced its hardware security module and renewed the DNSSEC keys for .uy at the Faculty of Engineering. NIC.UY published the account a week later. It says the university’s legal directorate provided notarial certification and that the ceremony followed technical and audit protocols. NIC.UY calls this its second renewal since adopting DNSSEC in 2015. A notary gives the procedure a formal witness; the report does not publish the certificate or a step-by-step transcript.

ICANN’s 29 October account is useful because it names a smaller role for the global coordinator: technical witness. It says SeCIU generated key-signing keys for both the current algorithm and another algorithm planned for introduction in the coming months. It also describes signing work and the allocation of credentials to designated participants. The account does not name the future algorithm, the key identifiers or the day it will begin signing. Those are the facts that would turn the new-key announcement into an activation record.

The IANA delegation register supplies the authority line that photographs of a crowded room cannot. It lists SeCIU / Universidad de la República as .uy’s manager and its administrative and technical contact organization. It displays an existing secure-delegation record and a last-updated date of 7 August 2026. The ceremony report and the delegation page therefore describe different stages: local key preparation and the public root-facing record. The latter page supplies no receipt tying its present record to the keys generated in October.

ICANN’s blog places the .uy event a few days after the DNS root key rollover. Those operations had different operators and keys. For .uy, the practical public question is what SeCIU announces when the planned algorithm goes live and what record lets relying parties trace that change. The witness list already tells readers who saw the room. The next record must tell them what changed outside it.

Sources