The CA (ECDSA P-256, 10 years) and the Ed25519 bundle signing key are created on first start, sealed with the master key and stored once (concurrent starts read back the winner). The agent-port server certificate is issued in memory; agent CSRs are signed for 14 days. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>