Public keys are never exchanged between subsystems – only the ePassports (open key certificates) + verification

[AlexTourski]

Description

On the call 24 Nov 2025 Merul mentioned that the public key could be send directly from one subsystem to another.
This is not secure and vulnerable to the man-in-the-middle attack.

Expected behavior

The right way:
The subsystem which needs the public key of the user:

• will get the ePassport
• check it out via the chain of CA signatures
• final check should be done with the root CA which is on board of the subsystem and was securely provided by the supplier (which means that this procedure also should be described and properly executed).
• only then the public key is considered trusted and could be used
• We also need an audit that it works like that in all components

[nsergey82]

Can we list all such cases?
What are these sub-systems? How are we even defining them? I assume this is all over the place?
Are they actually sending "raw" keys to each other, any part of any system has access to the vault, where all key information is freely available?
@coodos