Safe is a gRPC-managed PKI server that uses Shamir's secret sharing to encrypt the private keys of the issuers. This means that the database is useless for an attacker unless they possess an additional client secret.
The management interface, inspired by HCP Vault's PKI engine, is
5705
gRPC-based, and the specification (with docs) can be found in the ./proto directory. There is a Python client available in ./safe-py.