Standard
Internet standard (RFC 6962) requiring publicly-trusted TLS certificates to be recorded in public, append-only, cryptographically verifiable logs.
METR's inference key sat on a researcher's personal EC2 instance, and the agent handed it over when asked. The three-week burn would have cost about $600,000 if the model provider had not donated the credits.
Perspective Coverage
4 publishersReality
On a September 10 podcast, Eclypsium researchers walked from vulnerable signed UEFI shells to Fire Ant binaries wearing EDR agent names. The common thread is verification: a defender can check very little of that stack alone.
Reality
TLS inspection re-signs every connection with a root an administrator installed in the operating system trust store. Node, Python's certifi and Java's cacerts do not read that store, so one machine gives two different answers.
Reality
Google's Encrypted Client Hello rollout, wrapped in GREASE decoys so protected sessions look like everything else, removes the plaintext domain that SNI-based logging keys on. Jigsaw reports near-zero interference even in Russia and China.
Perspective Coverage
4 publishersReality
Google's ECH support hides the destination domain from anything watching the TLS handshake, but only when the app's networking library and the site's CDN both cooperate, so the breakage arrives unevenly.
Reality
The block from U+E0000 to U+E007F renders as nothing and pastes as whitespace, so the only reader is the model you sent to the page. The control that held was refusing to let that model pick a recipient.
Reality
A publicly trusted certificate issued for your domain and hosted elsewhere leaves one trace you can read for free: the Certificate Transparency entry the issuing CA had to create.
Reality