Real X.509 issuance, each certificate paired with a separate ML-DSA-65 attestation. The certificate stays classical; the attestation carries the post-quantum signature.
Root details are fetched on demand.
No certificates issued yet.