15 Years Safeguarding the Internet Root: A Personal Farewell
21/05/2025
By Carlos Martinez Cagnazzo, CTO
Today I am stepping down from a role I’ve held with honor and responsibility for the past fifteen years—serving as a crypto officer in one of the most unique and symbolic processes related to Internet architecture: the DNS root zone key signing ceremony. At first glance, this event might seem technical or abstract. Yet it carries a deeply human, almost ritualistic quality, a moment where the global community comes together to literally strengthen trust in the system that underpins our digital lives.
Known as the “key signing ceremony,” this procedure is organized by the Internet Corporation for Assigned Names and Numbers (ICANN) and is a pillar in the protection of the Domain Name System (DNS). The event is held four times a year at two specific locations: El Segundo, California, and Culpeper, Virginia, in the United States.
During these ceremonies, two types of cryptographic keys are used—a public key and a private key—which, when operating in sync, ensure the integrity of the DNS root zone. The main goal is to create a controlled and secure environment for using the Key Signing Key (KSK), which is the key that signs other keys in the system. Each session produces cryptographic signatures that will be used daily for more than three months to guarantee the validity and authenticity of the root zone.
This process was designed to bring together crypto officers once a year, a large and diverse group of security specialists from across the globe and from within the technical community itself, whose role is to witness and validate that the KSK is used securely and according to established protocols.
I must admit that every time I walked through the doors of the venue where the ceremony took place—in my case, on the West Coast—I was struck by a curious mix of solemnity and camaraderie. Because although everything is meticulously regulated, there’s something symbolic about what happens there, almost as if we are safeguarding something invisible, yet essential. Being part of this process ultimately meant contributing to ensuring that the Internet remains the open, secure, and trustworthy space many of us take for granted.
Not without a sense of nostalgia, the time has come for me to step down as crypto officer.Over time, I realized that only three of us original representatives remained, and I felt it was time to make room for other candidates. As I close this chapter, I find myself looking back with a sense of perspective. What started as an application driven more by curiosity than by certainty became a journey filled not only with technical but also with personal learnings. Because this role was never just about cryptography or protocols. It was also about community, transparency, and collaboration among peers who don’t always agree on the same perspectives but who share a key common ground: the importance of protecting the Internet as a common good.
(Free access, no subscription required)
The first ceremony I participated in was back in 2010, even before I worked at LACNIC. At the time, I was involved in community activities, volunteering and moderating a few mailing lists, among other roles.
Through this participation, I learned about a call for applications to represent the community in a very specific role: participating in signing the DNS root. At the time, I didn’t fully understand what this role entailed or what would be expected of me, so I started to read and research.
I discovered there was a formal selection process and applied, although it wasn’t easy. In addition to filling out a form, you had to provide three references from individuals who were well-recognized in the field. Finding those references was challenging, but I was lucky and secured three strong references, one of them from Raúl Echeberría, then LACNIC CEO. Some time later, I received confirmation that I had been accepted as a Trusted Community Representative (TCR) to serve as a crypto officer.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of LACNIC.