PKI and AI briefing · 31 October 2026. Two developments deserve attention: new survey evidence about certificate operations, and a proposed shared way for websites to express AI-training preferences. Neither is proof that a technical transition is already complete.
Certificate readiness: a survey, not a security audit
Sectigo released its crypto-agility report on 28 October. Among 500 senior decision-makers surveyed by Censuswide, 78% expected substantial PKI changes for post-quantum cryptography; 61% reported a certificate-related outage or incident in the previous year. These are respondents’ reports, not independently verified incidents. Sectigo sells certificate-management products. Its year-to-year comparisons are directional because the 2026 sample added APAC. The release date is verified; the announcement does not specify the survey’s fieldwork dates.
Our practical takeaway: ask for evidence behind “we are ready.” Can your team identify who owns each certificate, show that renewal actually reaches the application, and demonstrate an alert when that process fails? A dashboard showing successful issuance is not the same check as observing the certificate served to users. This is an operational checklist, not a test we performed on the survey participants.
AI-training preferences: announced support, future implementation
On 30 October, OpenAI announced support for a shared robots.txt training-preference signal. It aims to implement the signal in the coming months; this is not an announcement that deployment is complete. Existing crawler controls remain in place. The intended benefit is expressing a preference to participating providers without repeating a different rule for every company.
The linked 30 October individual Internet-Draft is work in progress, not an approved IETF standard. It proposes a purpose-specific token, __usage_ai-training, using familiar robots.txt groups. Training-use preferences and crawler traffic rules are separate: the proposed token is not itself a command to stop crawling. Absence of that token means no preference expressed through this mechanism. The proposal may change.
What website owners should check now
OpenAI’s current crawler documentation distinguishes GPTBot, for content that may be used in training, from OAI-SearchBot, for search. Their controls are independent. Do not assume blocking one produces the other outcome.
Our recommendation: write down the outcome you want before editing a configuration: training preference, search visibility, or access restriction. Keep existing intended controls until replacement behavior is documented and verified. A voluntary preference is not a substitute for authentication protecting private material. This briefing does not change any website settings or establish that any provider has already implemented the proposal.
Status at publication: survey released; provider commitment announced; technical mechanism proposed. No performance benchmark, crawler-enforcement test, or certificate-migration test was conducted for this article.