the certificate format (X.509) and the global institutional system around it (certificate authorities, root programs, audits) that secures the web - powerful, universal, and carrying forty years of accumulated complexity that codexproof deliberately declines to import.
Five rows of institution, five rows of pocketknife - what was kept and what was declined.
Etymology and backstory
X.509 was born in 1988 as part of the ITU's X.500 directory dream - certificates were meant to bind names in a global directory that never materialized. The web bolted onto it in the 1990s (SSL needed server identity), producing the CA industry: hundreds of trusted issuers, browser root programs as de facto regulators, audits, Certificate Transparency (RFC 6962) as the public log forcing CA honesty after high-profile mis-issuance incidents (DigiNotar 2011 being the canonical disaster).
Ecosystem
everything HTTPS. Also the reference point every alternative trust design defines itself against - SSH's trust-on-first-use, PGP's web of trust, DANE, and self-certifying schemes like did:key.
In codexproof
the deliberate contrast. No CAs (self-certifying anchors), no ASN.1/X.509 parsing surface, one policy instead of extension soup, no expiry calendar, and revocation made mandatory instead of vestigial. What is retained is the SHAPE: anchors, chains, revocation - PKI stripped to a pocketknife (Q21).