Markets · bedrock market · provisional
PKI and Encryption (certificate authorities, key management)
Register market (browser / os root-program inclusion, ccadb) plus ca/browser forum participation. The Kin Score Market layer reads each provider in its market:
who it integrates with, how deep those integrations go, and where the market publishes its own structure.
Methodology.
40providers measured
16 (40.0%)declare their own
8 (20.0%)covered by others only
2 (5.0%)distribution only (sell through, not integrations)
14 (35.0%)undeclared
3declare compatibility (report only, not weighted)
0in-market workflows shown
Provisional. Provisional and unweighted: the Market layer is not part of the composite or agent readiness. Leader lists are read within a position, never as one ranking. A provider that declares nothing we can
read is shown as undeclared, with no number: we never infer integrations.
Where this market publishes its structure
- CCADB AllCertificateRecordsCSVFormatv4 (ccadb.my.salesforce-sites.com) machine-readable, 10,344 records, 949 roots, 264 owners (roots or unconstrained subordinates); per-store Apple / Chrome / Microsoft / Mozilla status, audit type, auditor; 7 providers linked
- Mozilla CA Information Report (CAInformationReportCSVFormat) machine-readable, 69 CA owners with Company Website + CAA domains; the domain bridge, not an edge source
- CCADB AllCAAIdentifiersReportCSV machine-readable, CA owner -> recognized CAA domains; domain bridge only
- CA/Browser Forum members (cabforum.org/about/membership/members) machine-readable, 117 members (56 CAs, 13 certificate consumers, 9 associates, 39 interested parties); CA class only; 4 linked
- CCADB CAOwnerReportCSV not machine-readable: 404 (report retired); owner data read through AllCertificateRecords + the Mozilla CA Information Report
- WebTrust seal register (cert.webtrust.org) not machine-readable: per-seal pages issued by auditors (assessors, not suppliers); audit seals read through CCADB's audit columns as edge context
- ACME directory support not machine-readable: no register; a CA's ACME endpoint is a compatible shape (report-only), needs an `acme` entry in sweep-shape-compat.py
- FIDO Alliance certified products not machine-readable: owned by the identity market (FIDO MDS3 read there; directory under migration freeze)
Own = declares at least one integration itself; covered = visible only because an aggregator, standards body, regulator or partner contract names it; distribution-only = listed only on cloud marketplaces it sells through, a channel reported beside, never counted as its own declared integrations; undeclared = nothing we can read, so no number; declares_compatibility = providers with a `compatible` shape vote, report only (kin, 2026-10-13): never counted as own, never in depth or position.
Taxonomy how this market maps onto apis.io
Derived 2026-10-18 from the 40 providers in this market we could resolve in the
catalog. The percentage is the share of those providers carrying each one; it describes the market, not the tag or industry. Tag groups have no page of their own yet, so they are listed unlinked.
| Tags | Security 65%, Encryption 47%, Cryptography 33%, Certificates 33%, PKI 33%, Secrets Management 25%, Key Management 25% |
|---|
| Tag groups | Security 82%, Cryptography 70%, Certificates 45%, Developer Tools 20%, Authentication 20% |
|---|
| Industries | Cybersecurity & Identity 93%, Developer Tools & DevOps 33% |
|---|
| Areas | Security 65%, Encryption 47%, Authentication 10% |
|---|
| Capabilities | Cybersecurity Management 47% |
|---|
share of resolved cohort carrying it; tags >=0.20 & >=3 members (max 12, junk dropped), tag_groups >=0.20 (cooccurrence, non-cross-cutting; max 8), industries >=0.20 (max 6), areas >=0.10 (max 6; areas are keyword-matched and sparse), capabilities L1 >=0.20 (max 8); derive-market-taxonomy.py
Leaders by position (provisional)
Provisional: grouped by position, depth compared within a position only. Distribution (cloud marketplaces) and iPaaS bridges are counted beside
position, never inside it. Unknown-builder listings are left out of position shares and counted here.
builds-on 8 · publishes apps on other platforms' stores
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| CyberArk |
52.7 |
6 |
0 / 6 |
0 |
0 |
0 |
contract 17%, builds-on-platform 83% |
| Fortanix |
44.1 |
3 |
0 / 3 |
0 |
1 |
0 |
builds-on-platform 67%, distribution 33% |
| GoDaddy |
44.0 |
8 |
0 / 8 |
0 |
0 |
2 |
ipaas-bridge 25%, contract 25%, standard 12%, builds-on-platform 38% |
| Akeyless |
34.6 |
5 |
0 / 5 |
0 |
2 |
1 |
ipaas-bridge 20%, builds-on-platform 40%, distribution 40% |
| SandboxAQ |
17.2 thin |
1 |
0 / 1 |
0 |
0 |
0 |
builds-on-platform 100% |
| SecureW2 |
17.2 thin |
1 |
0 / 1 |
0 |
0 |
0 |
builds-on-platform 100% |
| SmallStep |
17.2 thin |
1 |
0 / 1 |
0 |
0 |
0 |
builds-on-platform 100% |
| Skyflow |
|
0 |
0 / 0 |
0 |
0 |
0 |
builds-on-platform 100% |
regulated 1 · named in a regulator's register or partners' contracts
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Virtru |
42.0 thin |
2 |
0 / 2 |
0 |
0 |
0 |
contract 50%, standard 50% |
standard 10 · listed by a voluntary standard's own directory
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Deutsche Telekom |
56.5 |
4 |
0 / 4 |
0 |
0 |
0 |
standard 100% |
| Network Solutions |
53.7 |
3 |
0 / 3 |
0 |
0 |
0 |
contract 33%, standard 67% |
| Digicert |
50.2 |
7 |
0 / 7 |
0 |
2 |
0 |
contract 14%, standard 43%, builds-on-platform 14%, distribution 29% |
| Keyfactor |
42.5 |
5 |
0 / 5 |
0 |
3 |
0 |
standard 33%, builds-on-platform 17%, distribution 50% |
| Let's Encrypt |
39.6 thin |
2 |
0 / 2 |
0 |
0 |
0 |
standard 100% |
| Sigstore |
34.5 thin |
2 |
0 / 2 |
0 |
0 |
0 |
standard 50%, builds-on-platform 50% |
| Telia Company |
31.9 thin |
2 |
0 / 2 |
0 |
1 |
0 |
standard 50%, distribution 50% |
| Cert-Manager |
17.2 thin |
1 |
0 / 1 |
0 |
0 |
0 |
standard 100% |
| HashiCorp Vault |
17.2 thin |
1 |
0 / 1 |
0 |
0 |
0 |
standard 100% |
| OpenBao |
17.2 thin |
1 |
0 / 1 |
0 |
0 |
0 |
standard 100% |
core 1 · builds the connectors its customers need
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Docusign |
56.0 |
71 |
20 / 51 |
0 |
1 |
2 |
partner-built 33%, provider-built 51%, ipaas-bridge 3%, contract 3%, standard 5%, builds-on-platform 4%, distribution 1% |
mixed 1 · no single mode dominates
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Infisical |
44.1 |
3 |
0 / 3 |
0 |
1 |
0 |
standard 33%, builds-on-platform 33%, distribution 33% |
list 1 · a long list on its own page, mostly unevidenced
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Paubox |
9.0 |
3 |
0 / 3 |
0 |
0 |
0 |
own-page 100% |
long-tail 2 · reached only through iPaaS bridges
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Evervault |
2.5 thin |
1 |
0 / 1 |
0 |
0 |
1 |
ipaas-bridge 100% |
| Venafi |
2.5 thin |
1 |
0 / 1 |
0 |
0 |
1 |
ipaas-bridge 100% |
distribution 2 · only sells through cloud marketplaces
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Anjuna |
19.2 thin |
2 |
0 / 2 |
0 |
2 |
0 |
distribution 100% |
| Appviewx |
9.6 thin |
1 |
0 / 1 |
0 |
1 |
0 |
distribution 100% |
undeclared 14 · declares nothing we can read: no number