[Human & Operations] Purchase VMC/CMC for Gmail verified BIMI

[patoperpetua]

Parent: #6
Imported from: singleton-sd/poc-plattform-kit#279

This is Human & Operations work, not agent implementation.

Goal

Enable “verified” BIMI logo display in Gmail (and other providers that require a certificate) by purchasing and configuring a VMC or CMC, then wiring it into PostKit email branding.

This was explicitly out of scope for the initial BIMI delivery on poc-plattform-kit.

Scope

1. Evaluate VMC vs CMC options for the sending brand/domain (per-tenant mail.<poc>.poc.singletonsd.com and/or a future shared domain).
2. Purchase certificate from an approved issuer.
3. Host the PEM at a stable public HTTPS URL (or provider-required location).
4. Set EMAIL_BIMI_EVIDENCE_URL in PostKit Function app settings (Key Vault reference if treated as a secret) on ssd-global-kv-prod-ae.
5. Update BIMI DNS TXT a= tag via the PostKit provisioner.
6. Re-run branding validation and send a test message.
7. Confirm logo rendering in Gmail after propagation.

Out of scope

• Code changes to BIMI sending logic.
• Outlook/Exchange logo display hacks (unsupported).

Acceptance criteria

• Certificate purchased and documented (issuer, expiry, renewal owner — no secret values in the issue).
• EMAIL_BIMI_EVIDENCE_URL configured for production as appropriate.
• BIMI DNS record includes non-empty a= pointing at the certificate PEM URL.
• Validator passes for the updated BIMI record.
• Gmail test inbox shows the brand logo on an authenticated test message (screenshot or link in a comment).

Notes

• Without VMC/CMC, Gmail may ignore BIMI even when DNS and headers are correct.
• Add a renewal reminder before cert expiry.
• Do not paste certificate private material into this public repository.