Simorgh Labs, FreeHSM, and a marketing claim we killed ourselves

2026-07-16

Two announcements today. One is cosmetic, one is not.

1. The rebrand (cosmetic, deliberate)

The repository freehsm-c is now freehsm. Old URLs redirect. Nothing else moves:

• Binary name stays libfreehsm.so.
• PKCS#11 identifiers stay as they are (manufacturerID = "Simorgh Labs").
• The GPG release key stays 743A 6A59 04A1 461A 6464 08DE 4856 0162 DBBF 28A2.
• GHSA identifiers already published are permanent.

The naming is now explicit: FreeHSM is the Apache-2.0 PKCS#11 library. Simorgh PKI is the product being built on top of it for v2.0 (a PKI CLI plus a signing toolkit). Simorgh Labs is the entity that will carry the FIPS 140-3 and CC EAL4+ submissions. A TRADEMARK.md now documents what you can do with the names (almost everything) and what you cannot (call your fork FreeHSM).

2. The claim we killed (not cosmetic)

Our v2.0 roadmap was built around a positioning line: “the first open-source PKI + signing toolkit with PQC composite signatures out-of-the-box.” Before putting it on a landing page, we did what we said we would do since the beginning of this project: we audited it as if we wanted it to fail.

It failed.

XiPKI 6.6.0 (Apache-2.0) shipped composite ML-DSA certificate issuance per draft-ietf-lamps-pq-composite-sigs on 2026-03-15 — months before our v2.0.0-beta target. Credit where due: it’s a solid, compact PKI, and its author co-authors IETF specs. Separately, SignServer 7.6 added composite signing in February 2026 (Enterprise edition only, for now), and the composite draft itself (draft-19) is in the RFC Editor queue, so everyone will converge on it soon.

The full audit — competitor matrix, dates, sources, retired claims — is in the repo: docs/PRIMACY_AUDIT_PQC_COMPOSITE.md. We publish it for the same reason we publish security advisories against ourselves: positioning claims that can’t survive an adversarial audit are technical debt with a marketing coat of paint.

So what are we, then?

What the audit clarified is that nobody in open source occupies the category we actually sit in. XiPKI is a PKI that talks to HSMs. Keyfactor sells a PKI and a signing server that talk to HSMs. SoftHSM emulates an HSM and stops there.

FreeHSM/Simorgh PKI is the HSM, the PKI, and the signing toolkit in one open-source product — PKCS#11 v3.2 module with FIPS 140-3 / CC EAL4+ evaluation documents, and (with v2.0) certificate issuance and code signing with PQC composite signatures out-of-the-box.

That is the claim we will ship with v2.0.0-beta. It doesn’t depend on winning a version-number race, and we re-audit it at tag time anyway.

Sign your code for the quantum era.