Confium in Production

Real-world deployments. From a flagship metrology certificate program to internal CA modernization, organizations use Confium to eliminate single points of failure in their signing infrastructure.

Featured deployments

International metrology certificate program

Metrology · Regulatory · 2026

A flagship international metrology body issues manufacturer model certificates under a threshold CA. The root key is split across multiple institutional parties; no single officer can issue alone.

  • • Threshold CA: 3-of-5 across director, technical officer, testing lab, manufacturer rep, standards liaison
  • • Every issued cert anchored to public transparency log
  • • Browser-verifiable via Confium Verify WASM

Ribose Internal PKI

Enterprise · Internal · 2026

Ribose replaced its single-key internal CA with a Confium threshold CA. Employee certificates now require 2-of-3 signing ceremonies (security team, IT ops, plus one external auditor) — eliminating the single trusted key.

  • • PKCS#11 server: existing openssl consumers work unchanged
  • • Monthly Herzberg share refresh across 3 signerd pods
  • • Prometheus monitoring + alerting on signing-op failures

NIST MPTS Evaluation

Testing · Standardization · 2026

NIST's Multi-Party Threshold Cryptography evaluation harness uses Confium as one of the reference implementations for threshold signature test vectors. Confium's CMP20 + FROST implementations are exercised against the MPTS test vector suite.

  • • Reference implementation status for CMP20, GG18, FROST-P256
  • • Test vector coverage in confium-test-harness
  • • Public evaluation report pending (NIST)

Mozilla Thunderbird (exploratory)

OSS · 35M+ users · exploratory

Thunderbird's OpenPGP signature verification path is being aligned with Confium's Verify product via RNP. The integration enables threshold-signed OpenPGP keys with browser-side verification — replacing the single-key Thunderbird update signing key with a threshold quorum.

  • • RNP integration via confium-composite for PQ-safe OpenPGP
  • • Transparency log anchoring for Thunderbird update signatures
  • • No Thunderbird UI changes; consumers see standard OpenPGP

By use case

HSM Replacement

Replace single-key HSMs with T-of-N threshold signing.

Threshold CA

Operate a CA without a single trusted root key.

Keyless Release Signing

OIDC-based signing for GitHub releases — no key management.

Tamper-Evident Audit Trails

RFC 6962 logs for compliance and regulatory use.

Bridge Signing

Cross-chain bridges with threshold custody.

Private Set Intersection

Compute on shared data without revealing it.

Become a featured deployment

Using Confium in production? Add yourself to ADOPTERS.md via PR, or tell us in Discussions. Featured deployments get a case study on this page; we'll work with you to shape the narrative.

Sponsorship & funding

Confium development is sponsored by:

  • NLnet Foundation — NGI Zero PET grant for open-source trust infrastructure
  • Mozilla MOSS — Open Source Support program
  • Ribose — project incubator and lead maintainer

See FUNDING.yml for current funding sources. Confium is BSD-2-Clause forever — no commercial edition, no open-core.