Internal certificate authorities fail on lifecycle, not on cryptography

Internal PKI outages rarely come from broken cryptography. They come from unknown ownership, unmanaged dependencies and rotation that stops at the CA without reaching the services that trust it.