The visitor side works without special knowledge. v0.1.0 shipped the mechanism; this is the release where following the README is enough.
The proxy was refusing every site — correctly
It relayed through pit.moshcode.sh:443, which only works if the gateway passes TLS through by SNI. It terminates instead, so every name presented the gateway's own certificate:
refuse alt.2600: key mismatch, presented ErIMn03cxhS+PK7UKUcSOY5pqegEhCn8Xvw4k3LqAnw=
refuse chovy.hacker: key mismatch, presented ErIMn03cxhS+PK7UKUcSOY5pqegEhCn8Xvw4k3LqAnw=
refuse seo.rank: key mismatch, presented ErIMn03cxhS+PK7UKUcSOY5pqegEhCn8Xvw4k3LqAnw=
Three names, one key. The proxy was doing its job and looked broken doing it. It now dials the origin the registry names, falling back to the gateway only when there is no target — which changes nothing about trust, since the pin still decides whether the connection lives (#13).
moshpit-trust never touched the store curl reads
It covered NSS and the macOS keychain and left /etc/ssl/certs alone, so curl <name> still failed on a machine that had been "set up" — reading as the whole scheme being broken rather than one store being missed. It now installs into the distribution's anchor directory and rebuilds the bundle, verifying the bundle contains the root rather than that a file landed in a directory: update-ca-certificates ignores anything not ending in .crt, silently, exiting zero (#13).
The origin stopped redirecting to a certificate nobody can verify
Port 80 serves the site instead of upgrading to an HTTPS URL a browser can neither resolve nor validate (#14).
Deployment
/opt/moshpit is a checkout, so merging ships (#15).
Verified
On a live box, over stock configuration — no gateway override, no local pin file:
ok alt.2600 (registry) TLSv1.3 hybrid-pq
ok auto.hacker (registry) TLSv1.3 hybrid-pq
ok seo.rank (registry) TLSv1.3 hybrid-pq
ok chovy.hacker (registry) TLSv1.3 hybrid-pq
curl returns 200 for each with no -k. 61 tests pass, up from 51.
Known limitation
An override supplies pins and no target, so an override-pinned name still relays through the gateway. Overrides exist for private grids that may have no registry at all, so skipping it is deliberate — letting an override carry its own target is the follow-up.
🤖 Generated with Claude Code