The WebPKI's Unmanaged Software Supply Chain

In The Private Key Was Four, I examined how eight eMudhra intermediate CA certificates ended up with private keys so weak that one of them was the integer 4. In Trusted Everywhere, Impact Everywhere, I looked at why a failure at a CA serving a small market becomes a problem for every relying party that trusts it, whether or not that relying party ever chose to use the CA. This article is about a third problem, which gets the least attention of the three and is getting worse as AI agents take on more work. Much of the software ecosystem inherits the WebPKI's global trust without needing its full scope and without receiving the protections browsers built to manage it. The stakes are hard to overstate. The web's security rests entirely on the WebPKI. Every HTTPS connection a browser makes to a public website is authenticated through it, browsers accept no alternative, and much of what software does besides browsing depends on it as well. Package registries, software update channels,…