ORDER OF MIGRATION
from the outer sphere (stored past) to the burning core (key exchange today)
5 · STORED AT REST
re-encrypt on rotation
4 · INTERNAL SERVICE MESH
mTLS · RPC auth · JWTs
3 · SHORT-LIVED SIGNATURES
sessions · tokens · JWT
2 · LONG-LIVED SIGNATURES
CA roots · code signing · OS
1 · KEY EXCHANGE
TLS 1.3 hybrid · ML-KEM-768
MIGRATE NOW
concentric priority · inner ring = today · outer ring = eventually
NODE
M