- Added PKI support for ACME & external CAs, Redis Sentinel, Kubernetes dynamic secrets, and certificate issuance against templates
- Introduced region flag, token period support, offline Lottie assets, and expanded billing permissions for machine identities
- Fixed AWS Secrets Manager sync policy constraints, HTTPS on K8s gateway hosts, and multiple access‑request handling bugs; improved key‑schema documentation