S02-TS: Yes
Rationale
The node key pair is generated locally and the private key stays on the device. Its cryptographic identity does not require an external key issuer.
Assessment method
Official documentation and pinned source/declaration review; no runtime test
Source context
Tailscale identity documentation, LocalAPI and PATENTS grant
Outstanding qualification
Credits only node-key creation. The selected managed service still requires enrollment and external user authentication, and Tailnet Lock signatures govern admission. S01 and S04 retain those authority dependencies.
Public sources
- https://tailscale.com/docs/concepts/tailscale-identity
- https://tailscale.com/docs/concepts/tailscale-identity
- https://raw.githubusercontent.com/tailscale/tailscale/566f89e0fb2aa4b2f1ebf98761e45e62aa5ef225/PATENTS
- https://raw.githubusercontent.com/tailscale/tailscale/566f89e0fb2aa4b2f1ebf98761e45e62aa5ef225/LICENSE
- https://raw.githubusercontent.com/tailscale/tailscale/566f89e0fb2aa4b2f1ebf98761e45e62aa5ef225/ipn/localapi/localapi.go
- https://tailscale.com/docs/install/linux
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round588.html
- round588-sources.json