  The signing key protection for Certificate Authorities (CAs) remains a
critical concern in PKI. These keys can be exposed by carefully designed
attacks or operational errors even today. Traditional protections fail to
eliminate such risk since attackers always manage to find an exploit path to
capture the digital key leakage. Even a single successful attack can compromise
the security. This everlasting dilemma motivates us to consider removing CA's
signing keys and propose Armored Core, a PKI security extension using the
trusted binding of Physically Unclonable Function (PUF) for certificate
operations. By eliminating explicit signing keys, it makes key exposure attacks
impossible.
  In Armored Core, we design a set of PUF-based X.509v3 TLS certificate
functions for CAs, where they generate physically trusted "signatures" without
using a fixed key. We formally prove the existential unforgeability of the
certificates. We propose the first PUF transparency mechanism to effectively
monitor the calling behaviors of PUF. We also provide an open-sourced
implementation where Armored Core is integrated into real-world PKI systems
like Let's Encrypt Pebble CA and Certbot. The results show that it achieves key
removal without any additional performance overhead. It offers a more trusted
basis for PKI security through efficient physical operations with compatible
functions.
