Post

Apple's draft policy for Merkle Tree Certificates caps validity at 7 days. Not a shorter X.509. A new post-quantum cert type, validated from periodic out-of-band client updates, so it only has to outlive the update cycle. 7 days costs nothing when nothing human renews it. #PKI