In May 1997 a group of MIT researchers published a distributed-caching paper with a modest stated ambition: protocols "that can be used to decrease or eliminate the occurrence of hot spots." A hot spot is what happens when everyone wants the same file at the same moment and one machine has to serve all of them. The contribution was a method for spreading objects across a shifting population of caches without reshuffling every assignment each time a cache joined or died. A load-distribution result. Nobody in that room was proposing a governance layer for the web.
Caching spread for load and latency long before the web was encrypted. What encryption added was custody. For a machine sitting near you to serve a site over HTTPS, it must present a credential valid for that site's own name and prove it holds the matching key. Your browser then authenticates it as the server for that name — not as an approved observer of somebody else's sealed conversation. As far as the browser is concerned, the edge node is the party the conversation was addressed to.
Everything downstream of that rests on who holds the key, and the industry has been visibly uneasy about it for years. Origins have handed private keys over outright, or kept them and answered a signing request on every handshake, or moved to delegated credentials, short-lived signing keys standardized in 2023 for the express purpose of limiting how much durable certificate authority ends up living inside a remote termination service. When an industry drafts a standard specifically to bound an exposure, that expenditure tells you what the ordinary arrangement actually is, and no vendor architecture page will.
From the addressed position the rest follows without anyone needing to argue for it. Hold the plaintext and you can cache it, route it, compress it, translate protocols, rewrite the markup, classify who is asking, and decline to answer. Each of those is a decision about content made by a party who is neither its author nor its reader. The end-to-end principle was never violated in any technical sense. The endpoint simply stopped being one place. And the multiplication is heaviest where the attention is: HTTP Archive's 2025 crawl detected CDN delivery on 71% of the top thousand mobile sites, with adoption thinning steadily as you move down the popularity curve.
Failure makes a shared position legible in a way that success never does. On June 8, 2021, a bug introduced into one edge provider's software in mid-May sat inert until a single customer made a perfectly valid configuration change. Around 85% of that network began returning errors, and thousands of governments, retailers, newsrooms, and streaming services went dark at once. Recovery took about an hour, which is fast. Those organizations shared no code, no market, and no relationship with one another. What they had in common was where they sat.
That position is now where purpose gets decided. I argued in an earlier piece that the traffic categories being drawn at this layer — search, agent, training, categories that sort a visitor by why it came rather than by what it technically does — are new institutional furniture, and that defaults set there function as policy. Sable Whitford put the sharper objection: purpose is inferred by a classifier watching behavior. Nobody declares it.
So the guessing came back. It relocated inside the envelope, where the reading is authorized, where the defaults are configured centrally, and where the number of places from which an outsider could watch it happen may now fit on one hand.