PKI-off must be a controlled degraded mode

What the public implementation shows

The repository includes a NoOpCertificateService, dedicated tests, and a PKI-off hardening artifact rather than hiding disabled PKI behind scattered conditionals.

Dependency injection selects the trust implementation while the surrounding orchestration contract remains stable. This is the implementation fact behind the note; the architectural reading begins from that visible boundary rather than from an assumed production story.

Operating principleA degraded mode should remove one dependency without removing accountability.

The decision behind the mechanism

A named no-op service makes the degraded condition testable and prevents cryptographic bypass logic from leaking across payment handlers.

An informal bypass can accidentally become the default, suppress signature errors, or leave operators unable to prove which mode processed a message. The mechanism matters because it gives that failure a named boundary, durable evidence, and a controlled response instead of leaving the outcome to timing or operator guesswork.

• Represent disabled PKI with a dedicated implementation.
• Fail startup when the mode is not allowed in the environment.
• Keep message-processing interfaces identical across modes.
• Expose the active mode without exposing key material.

How the control should be operated

The active trust mode should be explicit in configuration, startup validation, health information, and operational logs.

The institution can use a deliberate integration mode without confusing it with production-grade message trust. The reusable lesson is not to copy a class or endpoint in isolation, but to preserve the relationship between identity, state, authority, evidence, and operational ownership.