Wrote about my current project `attezt` that implements an attestation server for `device-attest-01`.
https://linderud.dev/blog/acme-device-attestation-smallstep-and-pkcs11-attezt/
ACME device attestation, smallstep and pkcs11: attezt
For my personal home infrastructure I’ve been using step-ca to have an internal ACME server for issuing TLS certificates for my .home.arpa domain. I also intended to use this to sign ssh certificates so I could simplify my SSH key setup. And i really like hardware bound keys. They solve a very concrete problem where even if someone can extract a signing key from your system, they are effectively useless without access to the hardware they where bound to. This hardware could be something like a yubikey, or another FIDO device. But in 2026 most of our machines have a Trusted Platform Module (TPM) that functions as a free hardware enclave we can use to secure our keys with.






