Building a certificate authority for the whole Internet

Cloudflare is becoming a public CA, and the interesting part isn’t the launch - it’s the reasoning. They issue millions of certificates a year through 16 partner CAs, which makes someone else’s outage or distrust event their problem. So: an established GlobalSign root (trusted since 2012) for old devices, a new root for modern ones, ACME for classic certs, and Merkle Tree Certificates for post-quantum in Q1 2027. Nothing is being issued yet.