Markets · bedrock market · provisional

PKI and Encryption (certificate authorities, key management)

Register market (browser / os root-program inclusion, ccadb) plus ca/browser forum participation. The Kin Score Market layer reads each provider in its market: who it integrates with, how deep those integrations go, and where the market publishes its own structure. Methodology.

40providers measured

21 (52.5%)declare their own

7 (17.5%)covered by others only

1 (2.5%)distribution only (sell through, not integrations)

11 (27.5%)undeclared

3declare compatibility (report only, not weighted)

0in-market workflows shown

Provisional. Provisional and unweighted: the Market layer is not part of the composite or agent readiness. Leader lists are read within a position, never as one ranking. A provider that declares nothing we can read is shown as undeclared, with no number: we never infer integrations.

Where this market publishes its structure

CCADB AllCertificateRecordsCSVFormatv4 (ccadb.my.salesforce-sites.com) machine-readable, 10,344 records, 949 roots, 264 owners (roots or unconstrained subordinates); per-store Apple / Chrome / Microsoft / Mozilla status, audit type, auditor; 7 providers linked
Mozilla CA Information Report (CAInformationReportCSVFormat) machine-readable, 69 CA owners with Company Website + CAA domains; the domain bridge, not an edge source
CCADB AllCAAIdentifiersReportCSV machine-readable, CA owner -> recognized CAA domains; domain bridge only
CA/Browser Forum members (cabforum.org/about/membership/members) machine-readable, 117 members (56 CAs, 13 certificate consumers, 9 associates, 39 interested parties); CA class only; 4 linked
CCADB CAOwnerReportCSV not machine-readable: 404 (report retired); owner data read through AllCertificateRecords + the Mozilla CA Information Report
WebTrust seal register (cert.webtrust.org) not machine-readable: per-seal pages issued by auditors (assessors, not suppliers); audit seals read through CCADB's audit columns as edge context
ACME directory support not machine-readable: no register; a CA's ACME endpoint is a compatible shape (report-only), needs an `acme` entry in sweep-shape-compat.py
FIDO Alliance certified products not machine-readable: owned by the identity market (FIDO MDS3 read there; directory under migration freeze)

Own = declares at least one integration itself; covered = visible only because an aggregator, standards body, regulator or partner contract names it; distribution-only = listed only on cloud marketplaces it sells through, a channel reported beside, never counted as its own declared integrations; undeclared = nothing we can read, so no number; declares_compatibility = providers with a `compatible` shape vote, report only (kin, 2026-10-13): never counted as own, never in depth or position.

Taxonomy how this market maps onto apis.io

Derived 2026-10-23 from the 40 providers in this market we could resolve in the catalog. The percentage is the share of those providers carrying each one; it describes the market, not the tag or industry. Tag groups have no page of their own yet, so they are listed unlinked.

Tags	Security 65%, Encryption 47%, Cryptography 33%, Certificates 33%, PKI 33%, Secrets Management 25%, Key Management 25%
Tag groups	Security 82%, Cryptography 70%, Certificates 45%, Developer Tools 20%, Authentication 20%
Industries	Cybersecurity & Identity 93%, Developer Tools & DevOps 33%
Areas	Security 65%, Encryption 47%, Authentication 10%
Capabilities	Cybersecurity Management 47%

share of resolved cohort carrying it; tags >=0.20 & >=3 members (max 12, junk dropped), tag_groups >=0.20 (cooccurrence, non-cross-cutting; max 8), industries >=0.20 (max 6), areas >=0.10 (max 6; areas are keyword-matched and sparse), capabilities L1 >=0.20 (max 8); derive-market-taxonomy.py

Leaders by position (provisional)

Provisional: grouped by position, depth compared within a position only. Distribution (cloud marketplaces) and iPaaS bridges are counted beside position, never inside it. Unknown-builder listings are left out of position shares and counted here.

builds-on 8 · publishes apps on other platforms' stores

Provider	Depth	Integrations	In / out	Distribution	iPaaS bridge	Mix
Akeyless	53.2	15	0 / 15	2	1	ipaas-bridge 7%, standard 27%, builds-on-platform 53%, distribution 13%
Keyfactor	53.1	15	0 / 15	5	0	standard 31%, builds-on-platform 38%, distribution 31%
Infisical	47.9	6	0 / 6	1	0	standard 17%, builds-on-platform 67%, distribution 17%
Appviewx	47.6	4	0 / 4	1	0	standard 25%, builds-on-platform 50%, distribution 25%
GoDaddy	46.0	10	0 / 10	0	2	ipaas-bridge 20%, contract 20%, standard 20%, builds-on-platform 40%
SmallStep	43.1	8	0 / 8	3	0	standard 12%, builds-on-platform 50%, distribution 38%
Fortanix	41.7	10	0 / 10	5	0	standard 20%, builds-on-platform 30%, distribution 50%
Skyflow	33.4	5	0 / 5	4	0	builds-on-platform 20%, distribution 80%

standard 14 · listed by a voluntary standard's own directory

Provider	Depth	Integrations	In / out	Distribution	iPaaS bridge	Mix
Cert-Manager	58.1	3	0 / 3	0	0	standard 67%, builds-on-platform 33%
Deutsche Telekom	56.5	6	0 / 6	0	0	standard 100%
Sigstore	55.6	5	0 / 5	0	0	standard 60%, builds-on-platform 40%
Network Solutions	53.2	4	0 / 4	0	0	contract 25%, standard 50%, builds-on-platform 25%
Telia Company	50.8	4	0 / 4	1	0	standard 75%, distribution 25%
Venafi	45.7	8	0 / 8	1	1	ipaas-bridge 12%, standard 38%, builds-on-platform 38%, distribution 12%
Let's Encrypt	40.9 thin	2	0 / 2	0	0	standard 100%
Anjuna	36.9	4	0 / 4	3	0	standard 25%, distribution 75%
IronCore Labs	34.5	4	0 / 4	3	0	standard 25%, distribution 75%
SandboxAQ	34.5 thin	2	0 / 2	0	0	standard 50%, builds-on-platform 50%
SecureW2	34.5 thin	2	0 / 2	0	0	standard 50%, builds-on-platform 50%
Evervault	34.1	9	0 / 9	5	1	ipaas-bridge 11%, standard 33%, distribution 56%
Defakto Security	26.8 thin	2	0 / 2	1	0	standard 50%, distribution 50%
HashiCorp Vault	17.2 thin	1	0 / 1	0	0	standard 100%

core 1 · builds the connectors its customers need

Provider	Depth	Integrations	In / out	Unknown builder	Distribution	iPaaS bridge	Mix
Docusign	60.3	81	20 / 61	0	1	3	partner-built 29%, provider-built 45%, ipaas-bridge 3%, contract 3%, standard 10%, builds-on-platform 7%, distribution 1%

mixed 4 · no single mode dominates

Provider	Depth	Integrations	In / out	Distribution	Mix
Digicert	59.7	13	0 / 13	2	contract 15%, standard 38%, builds-on-platform 31%, distribution 15%
CyberArk	57.8	17	0 / 17	0	contract 12%, standard 41%, builds-on-platform 47%
Virtru	51.1	9	0 / 9	2	contract 22%, standard 33%, builds-on-platform 22%, distribution 22%
OpenBao	44.1	3	0 / 3	1	standard 33%, builds-on-platform 33%, distribution 33%

list 1 · a long list on its own page, mostly unevidenced

Provider	Depth	Integrations	In / out	Unknown builder	Distribution	iPaaS bridge	Mix
Paubox	20.3	7	0 / 7	0	5	0	own-page 38%, distribution 62%

distribution 1 · only sells through cloud marketplaces

Provider	Depth	Integrations	In / out	Unknown builder	Distribution	iPaaS bridge	Mix
Virgil Security	28.8	6	0 / 6	0	6	0	distribution 100%

undeclared 11 · declares nothing we can read: no number

Provider	Depth	Integrations	In / out	Unknown builder	Distribution	iPaaS bridge
Amazon Certificate Manager	undeclared	-	-	-	-	-
Amazon KMS	undeclared	-	-	-	-	-
Amazon Private CA	undeclared	-	-	-	-	-
Baffle	undeclared	-	-	-	-	-
CipherTrust	undeclared	-	-	-	-	-
Google Cloud Certificate Manager	undeclared	-	-	-	-	-
Google Cloud KMS	undeclared	-	-	-	-	-
Azure Key Vault	undeclared	-	-	-	-	-
QuSecure	undeclared	-	-	-	-	-
Spirl	undeclared	-	-	-	-	-
SSL/TLS	undeclared	-	-	-	-	-

Generated 2026-10-24 from API Evangelist's own files; nothing on this page is a model's judgement. Provisional and unweighted; not part of the Kin Score composite or agent readiness. Read the Market layer methodology. Disagree with an edge? Every edge cites its evidence and can be corrected through the normal correction path.