Where keys are generated and stored, who may use them, and how they are rotated, revoked and recovered.
A certificate that expires in production was not forgotten by an individual. It was issued by a process that did not include renewal, into a system that had no way to reload it.
Choosing a well-regarded library settles very little. The decisions that determine whether cryptography protects anything are about where keys live, what a compromise reaches, and which threat you are actually addressing.
Most organisations can describe their intended key management and cannot answer the question for a specific key. The gap between the two is where incidents and failed audits come from.
Teams treat secure boot as a firmware feature and discover years later that the hard part was never verification. It was deciding who holds the signing key, how it rotates, and what happens when it is lost.
KEEP EXPLORING
Read the method, assumptions and questions to ask.