XKMS INTEGRATION REVIEW
Yenra | Updated October 3, 2026
Guide: https://yenra.com/xkms/

Purpose: connect key-information processing to a documented trust policy and
business decision. Use synthetic records in a controlled test environment.
Keep private keys and authentication secrets out of this worksheet.

IDENTITY AND OWNERSHIP
Assessment date / application owner / trust-service owner:
Business action protected by this integration:
Client implementation / exact version:
Server implementation / exact version:
Configured endpoint / namespace / transport:
Observed operations: Locate / Validate / registration / other
Documentation, configuration and redacted trace references:

TRUST AND DECISION
How the service is authenticated:
Trust-policy identifier / owner / evidence location:
Accepted signer identities and intended key uses:
Where returned key information is validated:
How response status is interpreted:
How intended signed content is identified:
Separate business authorization rule:
Response freshness and replay policy:
Audit evidence retained / access / retention owner:

LIFECYCLE AND FAILURE
Registration, revocation or recovery operations actually supported:
Who may invoke those operations:
Timeout / unavailable-service outcome:
Invalid / indeterminate / malformed-result outcomes:
Retry rules / transaction identity / duplicate-action handling:
Recovery owner / escalation / rollback decision:

TEST RECORD (DUPLICATE)
Test name / synthetic input reference:
Expected trust result:
Expected business outcome:
Actual result / evidence / reviewer:
Issue / owner / next step:

TEST SET
[ ] Known acceptable document accepted exactly once
[ ] Altered signed content rejected
[ ] Unexpected signer or key use rejected
[ ] Service outage follows the defined exception path
[ ] Invalid, indeterminate and malformed results handled distinctly
[ ] Retry preserves transaction identity and auditability
[ ] Authorized key but insufficient business permission cannot approve action

EXAMPLE (FICTIONAL)
A supplier's key and signed instruction pass trust checks. That supplier has
view-only delivery permission. The warehouse must still reject or route the
redirection request through its separately authorized approval process.

PRIMARY REFERENCES
XKMS 2.0, W3C Recommendation, June 28, 2005:
https://www.w3.org/TR/xkms2/
XKMS requirements and trust model:
https://www.w3.org/TR/xkms2-req/
XML Signature Best Practices, W3C Working Group Note, April 11, 2013:
https://www.w3.org/TR/xmldsig-bestpractices/
This is an assessment aid, not a production verifier or protocol test suite.