Gatekeeper: High Availability

[ianlivingstone]

The prototype of the Gatekeeper does not track or share any state, leaving a security vulnerability where a certificate could be turned in to multiple independent gatekeeper instances within the 5minute window for many different sets of credentials.

Therefore, in order for the Gatekeeper to be highly available, it requires some sort of consensus or data sharing mechanism for determining whether or not a certificate has been used. After the certificate window expires, it's no longer valid and can be forgotten.