The map of published trust — Tyche Institute

One hub, thirty-one lists

The European Union publishes a list of lists. Each member state, plus Iceland, Liechtenstein, Norway and an archived United Kingdom entry, publishes its own — naming the providers it supervises and the services they are trusted for.

Nothing here is drawn from a document we did not retrieve. Every circle is a file that answered.

31 machine-processable national lists, from one hub.

Forty-three pointers is not forty-three countries

The hub carries 43 pointers, and that is the number usually quoted. It is not a count of countries. 11 of them point at a human-readable PDF of a list that is already there in machine-processable form, and one points at the hub itself.

The small squares are those PDFs. They matter for the arithmetic: a fault in one list out of forty-three sounds like a rounding error, and the same fault out of thirty-one does not.

43 pointers = 31 lists + 11 PDF copies + 1 self-reference.

One of them did not answer — until 25 August

Ireland's trusted list is declared by the hub, and for twenty-five consecutive observations a strict client could not retrieve it. The server sent one certificate where two are needed: the intermediate linking it to a trusted root was missing, so verification failed before the file was ever read.

We notified the operator at 21:33 UTC on 24 August. The twenty-fifth failure came at 07:00 UTC on 25 August; at the next observation, at 09:26 UTC, the intermediate was there, the chain verified, and the list came down clean. The record dates the repair; it does not say what caused it. That is why a series matters more than a snapshot: the defect and its repair are both in the record, and neither is a screenshot.

Notified 21:33 UTC on 24 August 2026. Failed 25 observations in a row, the last at 07:00 UTC on 25 August; first clean run 09:26 UTC the same day. All 31 European lists now answer.

One is published without transport security at all

Slovakia's pointer is declared over plain http://, and answers there. On 25 August the same host over HTTPS presented a certificate for a different name, so the encrypted path was the one that failed. On 30 September it presented a certificate for its own name, valid from 3 September 2026, and answered a strict client cleanly; the pointer the hub declares is still the http:// one.

This is not the scandal it first looks like. The list carries its own XAdES signature, so its integrity does not depend on the transport. But a client configured to refuse plain HTTP — an increasingly ordinary policy — cannot follow the declared pointer at all.

The list is signed. The declared channel is not. Those are different guarantees, and only one of them is present.

There is a second hub, and no edge between them

The Americas publish a regional list of lists in the same ETSI format, under the same standard, covering Argentina, Brazil, Paraguay and Uruguay. Chile appears too — not through the regional hub, but through Argentina's own national list.

The two hubs do not mention each other. Not a broken link: no link. A client that knows how to read one has no path to the other.

But the disconnection is not symmetrical, and that took a second bloc to see. The Pacific Alliance — Chile, Colombia, Mexico, Peru — publishes four lists in the same format that do declare a pointer out, and it names an ec.europa.eu address as the list of lists for territory “AP”. It redirects to the European one. Four Latin American states have been declaring Brussels as their own regional hub since 2019, and Brussels has never pointed back.

0 edges between the EU and MERCOSUR hubs; four unreciprocated edges from the Pacific Alliance into the European one.

Five copies, three of them expired

On 25 August we found the regional list at four addresses across three states. All four answered. All four carried a signature block. Three were byte-for-byte identical at sequence 7, whose declared next update, 7 May 2026, was 110 days past; the fourth, in Brazil, was sequence 8 and current. A fifth address, in Paraguay, came into view on 10 September, when Paraguay's own list first answered our strict client and its pointer could be followed. On 8 October it served a byte-for-byte copy of the Brazilian sequence 8.

A signature proves who wrote a document. It does not say whether the document is still the one you should be reading. The only field that separates the current copies from the lapsed ones is the one no rule requires anybody to check.

Same standard, same signature check, 110 days apart on 25 August.

And then the islands — and a hub nobody arrives at

Some states publish a trusted list that no hub points at: Switzerland, the United Kingdom's live list, Serbia, North Macedonia, and Ukraine's national list — which, on 25 August, had been reissued the day before and was the freshest list anywhere in the graph. They are reachable and structurally invisible: you find them only if you already know the address.

We had Moldova and Ukraine in that group, and we were wrong. The European Union publishes a second list of lists, for mutual-recognition agreements, and it points at both. The first list of lists does not mention the second, so a crawl that starts at the famous hub — which is every crawl — never arrives. Ukraine appears twice and the EU points at the other one: a separate, EU-facing list with ten providers rather than the national list's twenty-one.

Serbia and Montenegro point at each other; Montenegro reaches Brussels only through Belgrade. North Macedonia's list fails the same way Ireland's did until 25 August — a chain that cannot be built.

What states publish when they publish no list

Most of the world does not publish a trusted list at all. What it publishes instead is a root certificate: the anchor itself, offered for download, with no statement about who else the state vouches for. Thirteen root distribution points from twelve states are drawn here as diamonds — from Argentina, India and Japan to Qatar, Russia, Taiwan and the United States — and two of them, Vietnam's and Bangladesh's, fail TLS validation to a strict client from both of our vantages. The defect that opened this page wearing a different flag.

They are deliberately joined to nothing. A trusted list is a claim about others; a root is a claim about yourself, and no pointer graph connects the two. Counting them together with the lists would produce a bigger number and a worse one.

One state sits between the two categories. South Korea publishes a genuine machine-readable national list — but as a sequence-numbered Microsoft-format certificate trust list and a JSON register, not as the European XML. It is drawn dashed, in its own population, because its register mixes test and development hierarchies in with the production ones — twelve of forty-two — and no status field marks which is which: only the names betray them.

The root and Korean labels are the only ones on this page we asserted ourselves: a certificate carries no SchemeTerritory to read.

Every one of these lists is somebody's legal obligation to publish. Not one of them is anybody's obligation to check.

That is the finding. The defects are individually small and mostly easy to fix — a missing intermediate, a stale mirror, an unencrypted pointer. What is not small is that they persisted long enough for a first look to find them, in infrastructure whose entire purpose is to be relied upon.

The instrument

Explore the whole graph

Every node is a published artefact that this instrument fetched. Hover any node for its country's name; click one for what was measured about it, and for whether its territory is something the publisher declared or something we asserted.

The numbers, and where each one comes from

31 of 31

European machine-processable lists that answer a strict client, after Ireland's was repaired on 25 August. Stated first because an instrument that only reports problems is campaigning, not measuring.

3 of 4

National pointers in the MERCOSUR regional list that answered in the latest run. Paraguay's could not be chain-verified from 25 August to 9 September — the same class of fault as Ireland's, in a different hemisphere. Since 10 September its chain has verified whenever the server answered.

2 of 5

Copies of the MERCOSUR list that were current on 8 October: the Brazilian one and, byte for byte, a Paraguayan one first seen on 10 September (on 25 August, 1 of 4). The other three are identical to each other; on 25 August they were 110 days past their declared next update of 7 May 2026.

Edges between the two regional hubs. Europe and the Americas each publish a list of lists, and neither has ever heard of the other.

The official monitor said it was fine

The European Commission publishes a live view of these same lists in its Digital Signature Services demonstration application. We read it once, on the morning of 25 August, after the twenty-five observations in which our strict client could not retrieve the Irish list. It reported that list SYNCHRONIZED — downloaded, parsed and validated — with a last successful download at 10:38 by its own clock.

Both were correct. The dashboard runs a client that completes a chain by fetching the certificate the server omitted; ours trusts only what the server actually sent. Nothing was broken in the monitor and nothing was wrong in our measurement. The endpoint was simply retrievable by one kind of client and not by another, and the monitoring in place was of the kind that could not see it.

That is the finding underneath all the others, and it is not about Ireland. A defect invisible to the instrument watching for defects will persist for as long as nobody looks with a different instrument. It also means this page is not a competitor to that dashboard: it is a second reading, and the two are useful precisely where they disagree.

Stated carefully

We are not claiming the Commission's tooling is wrong, nor that anybody was negligent. Chain completion by fetching a missing intermediate is normal, permitted client behaviour. The observation is narrower and harder to dismiss: two competent clients disagreed about whether a published national trusted list could be retrieved — ours had failed twenty-five times in a row when theirs reported success — and only one of them was being watched.

How we found the hub we had missed

For most of this measurement we reported Moldova and Ukraine as lists that nothing points at. That was wrong, and it was wrong in an instructive way: we had seeded the crawl at the European list of lists, and the European Union runs two. The second, for mutual-recognition agreements, currently declares exactly two territories — Ukraine and Moldova — and the first does not link to it. Every automated reading that begins at the well-known hub reproduces our error.

It surfaced only because an adversarial review of our own work went looking for what we had not measured. That is the argument for building the critic into the method rather than waiting for a reviewer: the correction cost an afternoon, and it would have cost a publication.

Then we asked the whole world

Two vantages are still not the world, so we asked it. On 25 August a TLS certificate check ran from the RIPE Atlas measurement network against two endpoints — Slovakia's, and Ireland's repaired one as a control — from 178 probes in 177 countries, on all six inhabited continents. This is one moment rather than a series, and it measures the transport and the certificate presented, not the signature on the list.

Ireland's repaired endpoint presented a certificate for its own name to 166 of the 178 probes; the other 12 saw no certificate at all, and none saw another name. Slovakia's endpoint did the opposite: it presented a certificate for its own name to not a single probe, on any continent. 177 probes saw a certificate for another name, which we withhold, and 1 saw none. That is no longer a question of where we stand to look. Its operator was notified on 25 August. This check is from that day; on 30 September the same host presented a certificate for its own name over HTTPS.

Each dot is one country the check ran from, grouped by continent; one of the 177 falls outside these six groups and is not drawn. An earlier run the same day, 479 probes in 75 countries, split the same way: the Irish control's own name on 460 probes and no certificate on 19; another name from the Slovak endpoint on 477 and no certificate on 2 (Atlas measurements 204352623 and 204352622).

177 countries

Where the 178 probes stood, across all six inhabited continents. Stated as a number so that “from everywhere” is a measurement and not a flourish.

166 of 178

Probes to which the repaired Irish control endpoint presented a certificate for its own name. The other 12 saw no certificate; none saw another name. Atlas measurement 204372082.

0 of 178

Probes to which the Slovak endpoint presented a certificate for its own name on 25 August. 177 saw another name, which stays withheld; 1 saw no certificate. Atlas measurement 204372076.

Why the raw probe counts are not the finding

A bare TLS probe that omits the server name reports a content-delivery network's default certificate as though the list were misconfigured; even with the name sent, cloud hosting can hand a default certificate to some vantages and the real one to others. Every figure above reconciles the measurement network's result against a fetch of each pointer's actual URL. After that reconciliation, on 25 August, exactly one endpoint failed from every vantage and every method; every other list validated when it was fetched the way software fetches it. The measurement that is easiest to run is the one most likely to invent a defect.

What this does not claim

It is not a security assessment

This measures whether a published endpoint answers a strict TLS client, and what each list says about its own currency. It is not signature validation, not supervision, not a legal determination, and not a vulnerability report. Nothing here is exploitable; several things here are simply not maintained.

A short series, and it says so

A run count is not a duration. This series is young, and that bounds what it can support: a pointer that failed every observation failed persistently within this window, which is not the same as a long-standing defect. Ireland's is the exception only because its repair happened inside the window and is therefore in the record. The classifier changed once, on 25 August, when refusals were separated from server errors; counts either side of that change are not the same measurement, and the analysis refuses to merge them.

Two vantage points, one moment

The series is measured from a single host in Estonia. Anything that fails there is asked once more from a second declared vantage on another network, because one host cannot tell “refuses everyone” from “refuses us”. Where the two disagree, the disagreement is the finding and both answers are published; we do not report the more convenient one. Two vantages are still not the world — so the one-moment worldwide check reported above was run separately; being a snapshot, it does not extend this window.

Labels are attributed

A node's territory comes from the list's own SchemeTerritory, or from the pointer that declares it. Ireland's list did not answer us until 25 August; it was labelled IE then because the European hub said so, not because we read it off a filename. Where we asserted a label ourselves, the panel says so.

Operators hear from us first

Where a named operator is involved we write to them before publishing, and a fix before publication is the outcome we would rather report. We do not route around a refusal. The second vantage identifies itself in its User-Agent, fetches only a fixed allowlist of the artefacts already measured here, and returns the observation rather than the document — it is an observation post, not a way to obtain something an operator has decided not to serve. A result gained by evading a block would not be a measurement of what a client sees.

Reproducing this

The instrument is three small programs and an append-only directory of dated runs. The classifier is declared in code before any percentage is computed, populations are never merged, and the page you are reading is generated from the run files rather than written by hand. Two defects the instrument found in itself — parallel workers manufacturing their own timeouts, and a namespace-blind parser misreading every prefixed list — are recorded in the README instead of quietly patched.

probe.py	transport: does the endpoint answer a strict client
freshness.py	declared currency: issue date, next update, terminal lists
graph.py	structure: who declares a pointer to whom, followed transitively
export_web.py	assembles this page's data from the recorded runs
checks.yaml	one card per check: the clause it rests on and its RFC 2119 level, or a written statement that it has no normative anchor and why — and, for every one, what it does not establish. The build refuses to publish a check without one.

—