Internet health developments

Material developments in the Internet's shared trust roots: certificate authorities and trust stores, DNS and naming, routing, and package and signing infrastructure. A development needs no CVE, named victim or exploitation, and ICHI infers none.

How developments are selected

• A report counts when its own headline states a trust event (a compromise, mis-issuance, distrust, revocation or hijack) in a shared trust root, or an emergency action on one. Commentary, marketing, hypothetical attacks and outages alone do not count; a single malicious package is a supply-chain item, not a trust root.
• A development reaches the homepage Priority Intelligence panel only when a report states a trust event, its reach across the ecosystem, and the action operators must take or that was taken for them; at least one organisation's own document states it; it rests on two evidence bases (every newsroom together is one); and its latest development is within 72 hours, by the publisher's own date. After that it stays here and in search.
• Exploitation is never inferred, and no exposure figure is attached.

Coverage audit