The LAAVAT platform: PKI, signing and encryption as a managed service
One platform for PKI, signing and encryption
We run your PKI, sign your firmware across your chipsets, and issue each device a trusted identity. Every key lives in FIPS-validated HSMs; every operation is governed, approved and audited. You integrate over REST or EST and go live in days.
Everything you need for HSM-backed PKI and signing
PKI
Full hierarchies with internal or external roots. ECC, RSA and post-quantum ML-DSA CA chains, including hybrid hierarchies and composite certificates. 802.1AR IDevID and LDevID, TLS and code-signing certificates. EST and REST enrolment, CRL lifecycle.
Signing & encryption
Secure boot for NXP HAB (CST) and AHAB (SPSDK), AMD/Xilinx Bootgen and TI; MCUs on MCUboot — STM32, Nordic, Renesas, Microchip. FIT (mkimage), MCUboot (imgtool), RAUC, SWUpdate, Mender, OP-TEE trusted applications, OCI/Cosign, Windows, Java, JWT and detached signatures — with ECDSA, RSA or post-quantum ML-DSA keys, or both as hybrid dual signatures. AES-GCM-256 image encryption, key delivery to manufacturing, key escrow and export.
Governance & audit
Entra ID or Google SSO, RBAC, group-based signing policies and quorum approvals. Every key and signing action in an immutable, exportable audit trail — ready for your SIEM. Web GUI plus a documented REST API with Swagger.
Three foundations every CRA-ready device needs
1
Secure boot
Only verified firmware runs, anchored in a hardware root of trust with each boot stage authenticating the next. Example: NXP i.MX AHAB secure boot and signed containers.
2
Secure firmware updates
Signed, optionally encrypted update bundles delivered over the air for the product's whole lifetime. Example: RAUC-based Linux OTA with one-time per-bundle certificates.
3
Strong device identity
Tamper-resistant per-device certificates for mutual TLS, attestation and clean factory onboarding, issued over REST or EST on the production line.
Why LAAVAT
HSM-protected keys
Every CA and signing key, classical or post-quantum ML-DSA, is generated and used inside FIPS-validated AWS CloudHSM. Keys are never exposed in the clear.
Built for builders
A clean web GUI plus well-documented REST APIs for development, manufacturing and OTA — with a Yocto recipe and ready-made clients for CI/CD pipelines and provisioning stations.
SSO and strong governance
Entra ID or Google SSO, group-based signing policies, and quorum approvals for critical operations.
Managed and maintained
Delivered as SaaS. We run the HSMs, PKI and signing tooling and keep them updated. Run it EU-hosted, with your own HSM in your own AWS account, or on-premises for sovereignty-critical deployments — with secure key export on demand.
Frequently asked
01
Which chipsets and formats are supported?
NXP HAB/AHAB, AMD/Xilinx Bootgen, TI, and MCUboot-based MCUs (STM32, Nordic, Renesas, Microchip); FIT, MCUboot, RAUC, SWUpdate, Mender, OP-TEE, OCI/Cosign, Windows, Java and JWT. Per-format guides are in the docs.
03
Can we take our keys with us?
Yes. Secure key export is available on demand. There is no vendor lock-in.
05
Do you support post-quantum signatures?
Yes. ML-DSA-44, ML-DSA-65 and ML-DSA-87 (NIST FIPS 204) signing and CA keys are generated and used inside AWS CloudHSM in FIPS mode. Devices you ship today will still be in the field when the EU expects high-risk systems to be quantum-safe (2030).
02
Where are the keys stored?
Inside FIPS-validated AWS CloudHSM, generated there and never exported in the clear — or in your own HSM in your own AWS account, or on-premises.
04
How long does integration take?
Most teams sign from their pipeline on day one using the REST API or the reference client. A proof of concept on a real use case typically follows the two-week evaluation.
06
Which hybrid schemes are supported?
ML-DSA + ECDSA dual signatures on firmware and update images, hybrid CA hierarchies that mix post-quantum and classical CAs, and composite ML-DSA certificates (IETF LAMPS). Devices can verify ECDSA today and ML-DSA once their silicon supports it.
One platform across build, factory and field
Your build system, device management, identity provider and SIEM connect to LAAVAT over REST and EST. Signing requests and certificate requests go in; signed artifacts, device certificates and the audit trail come back. On the production line, the provisioning station requests a certificate for every unit built. In the field, devices verify every boot stage and every update against the trust anchors you provisioned. Crypto-agile by design: move from ECDSA to hybrid to pure ML-DSA without rebuilding your pipeline.
