The internet has a built-in universal PGP equivalent, BTW. You can use an HTTPS certificate to send a secret message. To send to example.com: 1) get the public part of its certificate and verify its authenticity openssl s_client -connect example.com:443 -servername example.com -verify_hostname example.com -verify_return_error </dev/null > site-chain.pem && openssl x509 -in site-chain.pem -out site.pem 2) encrypt the message openssl cms -encrypt -aes-256-gcm -out message.cms site.pem <<< "Sauce for the goose is secure for the gander." 3) (as example.com) decrypt the message openssl cms -decrypt -in message.cms -inkey privkey.pem -recip site.pem Signing the outgoing message is an exercise for the reader. (Of course, for this system to work, you need the TLS terminator private key, and you have to be using encryption-capable cryptography like RSA in the certificate. Your tools will also whine at you that the certificate isn't "authorized" for encryption. You don't have to care what the CA "authorized". You can just do cryptographic things.)

RE: Tailworm 1. The "report" is totally unreadable. I, as someone who is very familiar with reporting vulns and kubernetes, am totally unable to parse the sections on kubernetes. There may be valid bugs, but I can't tell. I would not have reported these as vulns in this state.