Edge infrastructure for latency-bound security workloads.

OCSP responses pre-signed at the CA and replicated to every PoP; delta CRLs and CRLite-style filters distributed the same way. Revocation reaches all 32 nodes in < 60s. CT logs are mirrored and monitored with sub-hour alerting on mis-issuance.

Root stores, DNSSEC anchors, SSH CA keys and hybrid PQ KEM public keys served as signed, versioned bundles. Short-lived credential issuance and KMS envelope-decrypt brokered at the PoP; private keys stay in HSMs behind the backbone.

Over 25,000 km of leased dark fibre plus dedicated submarine capacity, lit with our own DWDM. Inter-regional traffic is MACsec-encrypted at Layer 2 and never traverses the public internet. AS216096 takes transit from Arelion (AS1299), NTT (AS2914), Cogent (AS174) and GTT (AS3257), plus Hurricane Electric (AS6939), and peers at 30 internet exchanges — no client path depends on a single upstream. PTP-disciplined clocks at every PoP for RFC 3161 timestamping and log ordering.

Endpoint and network telemetry terminates at the nearest PoP, is normalised and forwarded over the backbone. Sketch-based aggregation (Count-Min, HyperLogLog) runs at ingress so detection thresholds adapt before data reaches the core.

DNSSEC-validating DoT/DoH resolvers with pre-signed zones and RPZ feeds updated from the advisory pipeline. Anycast-served, so validation cost is paid within the same budget as an unvalidated answer.

6.4 Tbps of scrubbing capacity, inline at every PoP — not a separate scrubbing centre. Attack traffic never reaches the backbone and clean-traffic P99 is unchanged during an attack.