Certified secure erase (Zero Trace)

Zero Trace is a bootable USB that wipes a drive and issues a signed certificate
of erasure. It exists because "we wiped it" is not evidence, and a client
disposing of hardware often needs evidence.

How it works

1. Boot the machine from the Zero Trace USB.
2. Choose the client and the ticket the work belongs to, and who is doing it.
3. Choose the drive. The tool shows enough to tell a client's backup disk from
the machine's own SSD: transport, contents and the machine it is in.
4. It detects the media and runs the correct NIST 800-88 sanitisation for it.
5. It verifies the result by reading back sampled regions.
6. It submits a certificate to Atlas, signed with your organisation's key.

The certificate

Each certificate records the drive, the method, the standard, who performed it,
any witness, and the outcome. It is signed with an Ed25519 key held per
organisation, and carries a fingerprint plus a public verification link — anyone
holding the certificate can check it without logging in.

A wipe that passes with caveats (an HPA/DCO that could not be removed, a readback
that could not be verified) is recorded as a pass with limitations, not as a
clean pass. Those are the ones worth reviewing.

A certificate can be withdrawn, with a reason that appears on the public
verification page. It stays verifiable; it is never deleted.

Offline working

The bench does not need a working network. Certificates queue in a journal on
the USB and upload when it next reaches Atlas.

Current status

The Atlas side is complete and the image is built, stamped and hosted. The
SSD/NVMe edge-case matrix — ATA frozen state, HPA/DCO, USB-SATA bridges, NVMe
sanitize progress, RAID members — is being reworked against real drives and
should be treated as unproven until that lands. Boot every new build on target
hardware before promoting it.