Made on the CI box by ci/pki/make-ca.sh (2026-11-07 16:50 UTC): subject O=StarshipOS, CN=StarshipOS Capsule Signing; issuer O=StarshipOS, CN=StarshipOS Root CA; 2026-11-07 to 2036-11-06; CA:TRUE, pathlen:0; Ed25519. SHA-256 of the DER 13a28dda4098ef4f11cba42823a30a9898fdaffdf0c15130126fd2fe029b9a6c. Its key is the repository secret CAPSULE_SIGN_KEY; the root's stays on the box. The snakeoil intermediate leaves the tree (its history is in git). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2