diff --git a/proto/spire/api/server/localauthority/v1/localauthority.pb.go b/proto/spire/api/server/localauthority/v1/localauthority.pb.go
index 0da7aba..d7b4257 100644
--- a/proto/spire/api/server/localauthority/v1/localauthority.pb.go
+++ b/proto/spire/api/server/localauthority/v1/localauthority.pb.go
@@ -889,6 +889,180 @@ func (x *TaintX509AuthorityResponse) GetTaintedAuthority() *AuthorityState {
 	return nil
 }
 
+type TaintX509UpstreamAuthorityRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// This is the X.509 Subject Key Identifier (or SKID) of the
+	// authority's CA certificate of the upstream X.509 authority to taint.
+	SubjectKeyId string `protobuf:"bytes,1,opt,name=subject_key_id,json=subjectKeyId,proto3" json:"subject_key_id,omitempty"`
+}
+
+func (x *TaintX509UpstreamAuthorityRequest) Reset() {
+	*x = TaintX509UpstreamAuthorityRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TaintX509UpstreamAuthorityRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TaintX509UpstreamAuthorityRequest) ProtoMessage() {}
+
+func (x *TaintX509UpstreamAuthorityRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TaintX509UpstreamAuthorityRequest.ProtoReflect.Descriptor instead.
+func (*TaintX509UpstreamAuthorityRequest) Descriptor() ([]byte, []int) {
+	return file_spire_api_server_localauthority_v1_localauthority_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *TaintX509UpstreamAuthorityRequest) GetSubjectKeyId() string {
+	if x != nil {
+		return x.SubjectKeyId
+	}
+	return ""
+}
+
+type TaintX509UpstreamAuthorityResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *TaintX509UpstreamAuthorityResponse) Reset() {
+	*x = TaintX509UpstreamAuthorityResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TaintX509UpstreamAuthorityResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TaintX509UpstreamAuthorityResponse) ProtoMessage() {}
+
+func (x *TaintX509UpstreamAuthorityResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TaintX509UpstreamAuthorityResponse.ProtoReflect.Descriptor instead.
+func (*TaintX509UpstreamAuthorityResponse) Descriptor() ([]byte, []int) {
+	return file_spire_api_server_localauthority_v1_localauthority_proto_rawDescGZIP(), []int{19}
+}
+
+type RevokeX509UpstreamAuthorityRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// This is the X.509 Subject Key Identifier (or SKID) of the
+	// authority's CA certificate of the upstream X.509 authority to revoke.
+	SubjectKeyId string `protobuf:"bytes,1,opt,name=subject_key_id,json=subjectKeyId,proto3" json:"subject_key_id,omitempty"`
+}
+
+func (x *RevokeX509UpstreamAuthorityRequest) Reset() {
+	*x = RevokeX509UpstreamAuthorityRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RevokeX509UpstreamAuthorityRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RevokeX509UpstreamAuthorityRequest) ProtoMessage() {}
+
+func (x *RevokeX509UpstreamAuthorityRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RevokeX509UpstreamAuthorityRequest.ProtoReflect.Descriptor instead.
+func (*RevokeX509UpstreamAuthorityRequest) Descriptor() ([]byte, []int) {
+	return file_spire_api_server_localauthority_v1_localauthority_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *RevokeX509UpstreamAuthorityRequest) GetSubjectKeyId() string {
+	if x != nil {
+		return x.SubjectKeyId
+	}
+	return ""
+}
+
+type RevokeX509UpstreamAuthorityResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *RevokeX509UpstreamAuthorityResponse) Reset() {
+	*x = RevokeX509UpstreamAuthorityResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RevokeX509UpstreamAuthorityResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RevokeX509UpstreamAuthorityResponse) ProtoMessage() {}
+
+func (x *RevokeX509UpstreamAuthorityResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RevokeX509UpstreamAuthorityResponse.ProtoReflect.Descriptor instead.
+func (*RevokeX509UpstreamAuthorityResponse) Descriptor() ([]byte, []int) {
+	return file_spire_api_server_localauthority_v1_localauthority_proto_rawDescGZIP(), []int{21}
+}
+
 type RevokeX509AuthorityRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -905,7 +1079,7 @@ type RevokeX509AuthorityRequest struct {
 func (x *RevokeX509AuthorityRequest) Reset() {
 	*x = RevokeX509AuthorityRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[18]
+		mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[22]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -918,7 +1092,7 @@ func (x *RevokeX509AuthorityRequest) String() string {
 func (*RevokeX509AuthorityRequest) ProtoMessage() {}
 
 func (x *RevokeX509AuthorityRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[18]
+	mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[22]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -931,7 +1105,7 @@ func (x *RevokeX509AuthorityRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RevokeX509AuthorityRequest.ProtoReflect.Descriptor instead.
 func (*RevokeX509AuthorityRequest) Descriptor() ([]byte, []int) {
-	return file_spire_api_server_localauthority_v1_localauthority_proto_rawDescGZIP(), []int{18}
+	return file_spire_api_server_localauthority_v1_localauthority_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *RevokeX509AuthorityRequest) GetAuthorityId() string {
@@ -952,7 +1126,7 @@ type RevokeX509AuthorityResponse struct {
 func (x *RevokeX509AuthorityResponse) Reset() {
 	*x = RevokeX509AuthorityResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[19]
+		mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[23]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -965,7 +1139,7 @@ func (x *RevokeX509AuthorityResponse) String() string {
 func (*RevokeX509AuthorityResponse) ProtoMessage() {}
 
 func (x *RevokeX509AuthorityResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[19]
+	mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[23]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -978,7 +1152,7 @@ func (x *RevokeX509AuthorityResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RevokeX509AuthorityResponse.ProtoReflect.Descriptor instead.
 func (*RevokeX509AuthorityResponse) Descriptor() ([]byte, []int) {
-	return file_spire_api_server_localauthority_v1_localauthority_proto_rawDescGZIP(), []int{19}
+	return file_spire_api_server_localauthority_v1_localauthority_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *RevokeX509AuthorityResponse) GetRevokedAuthority() *AuthorityState {
@@ -1002,7 +1176,7 @@ type AuthorityState struct {
 func (x *AuthorityState) Reset() {
 	*x = AuthorityState{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[20]
+		mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[24]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1015,7 +1189,7 @@ func (x *AuthorityState) String() string {
 func (*AuthorityState) ProtoMessage() {}
 
 func (x *AuthorityState) ProtoReflect() protoreflect.Message {
-	mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[20]
+	mi := &file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[24]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1028,7 +1202,7 @@ func (x *AuthorityState) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuthorityState.ProtoReflect.Descriptor instead.
 func (*AuthorityState) Descriptor() ([]byte, []int) {
-	return file_spire_api_server_localauthority_v1_localauthority_proto_rawDescGZIP(), []int{20}
+	return file_spire_api_server_localauthority_v1_localauthority_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *AuthorityState) GetAuthorityId() string {
@@ -1171,128 +1345,164 @@ var file_spire_api_server_localauthority_v1_localauthority_proto_rawDesc = []byt
 	0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79,
 	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x53, 0x74, 0x61,
 	0x74, 0x65, 0x52, 0x10, 0x74, 0x61, 0x69, 0x6e, 0x74, 0x65, 0x64, 0x41, 0x75, 0x74, 0x68, 0x6f,
-	0x72, 0x69, 0x74, 0x79, 0x22, 0x3f, 0x0a, 0x1a, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x58, 0x35,
-	0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x5f,
-	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72,
-	0x69, 0x74, 0x79, 0x49, 0x64, 0x22, 0x7e, 0x0a, 0x1b, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x58,
-	0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5f, 0x0a, 0x11, 0x72, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x64, 0x5f,
-	0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x32, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74,
-	0x79, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x53, 0x74,
-	0x61, 0x74, 0x65, 0x52, 0x10, 0x72, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x64, 0x41, 0x75, 0x74, 0x68,
-	0x6f, 0x72, 0x69, 0x74, 0x79, 0x22, 0x52, 0x0a, 0x0e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
-	0x74, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x6f,
-	0x72, 0x69, 0x74, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x61,
-	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x65, 0x78,
-	0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09,
-	0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x32, 0x93, 0x0c, 0x0a, 0x0e, 0x4c, 0x6f,
-	0x63, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x99, 0x01, 0x0a,
-	0x14, 0x47, 0x65, 0x74, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79,
-	0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x3f, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75,
-	0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4a, 0x57,
-	0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x40, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61,
-	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4a,
-	0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x96, 0x01, 0x0a, 0x13, 0x50, 0x72, 0x65,
-	0x70, 0x61, 0x72, 0x65, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79,
-	0x12, 0x3e, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
-	0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x4a, 0x57, 0x54,
-	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x3f, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
-	0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x4a, 0x57, 0x54,
-	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x99, 0x01, 0x0a, 0x14, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4a, 0x57,
-	0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x3f, 0x2e, 0x73, 0x70, 0x69,
+	0x72, 0x69, 0x74, 0x79, 0x22, 0x49, 0x0a, 0x21, 0x54, 0x61, 0x69, 0x6e, 0x74, 0x58, 0x35, 0x30,
+	0x39, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x24, 0x0a, 0x0e, 0x73, 0x75, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0c, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x22,
+	0x24, 0x0a, 0x22, 0x54, 0x61, 0x69, 0x6e, 0x74, 0x58, 0x35, 0x30, 0x39, 0x55, 0x70, 0x73, 0x74,
+	0x72, 0x65, 0x61, 0x6d, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x4a, 0x0a, 0x22, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x58,
+	0x35, 0x30, 0x39, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x41, 0x75, 0x74, 0x68, 0x6f,
+	0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x24, 0x0a, 0x0e, 0x73,
+	0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4b, 0x65, 0x79, 0x49,
+	0x64, 0x22, 0x25, 0x0a, 0x23, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x58, 0x35, 0x30, 0x39, 0x55,
+	0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x3f, 0x0a, 0x1a, 0x52, 0x65, 0x76, 0x6f,
+	0x6b, 0x65, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x74, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x61, 0x75,
+	0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x49, 0x64, 0x22, 0x7e, 0x0a, 0x1b, 0x52, 0x65, 0x76,
+	0x6f, 0x6b, 0x65, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5f, 0x0a, 0x11, 0x72, 0x65, 0x76, 0x6f,
+	0x6b, 0x65, 0x64, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68,
+	0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x74, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x10, 0x72, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x64,
+	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x22, 0x52, 0x0a, 0x0e, 0x41, 0x75, 0x74,
+	0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x61,
+	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x49, 0x64, 0x12, 0x1d,
+	0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x03, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x32, 0xf2, 0x0e,
+	0x0a, 0x0e, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79,
+	0x12, 0x99, 0x01, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f,
+	0x72, 0x69, 0x74, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x3f, 0x2e, 0x73, 0x70, 0x69, 0x72,
+	0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63,
+	0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x47,
+	0x65, 0x74, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x53, 0x74,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x40, 0x2e, 0x73, 0x70, 0x69,
 	0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f,
 	0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e,
-	0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f,
-	0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x40, 0x2e, 0x73, 0x70,
-	0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c,
-	0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31,
-	0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68,
-	0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x90, 0x01,
-	0x0a, 0x11, 0x54, 0x61, 0x69, 0x6e, 0x74, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
-	0x69, 0x74, 0x79, 0x12, 0x3c, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68,
-	0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x61, 0x69, 0x6e, 0x74, 0x4a, 0x57,
-	0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x3d, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72,
-	0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x61, 0x69, 0x6e, 0x74, 0x4a, 0x57, 0x54, 0x41,
-	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x93, 0x01, 0x0a, 0x12, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x4a, 0x57, 0x54, 0x41, 0x75,
-	0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x3d, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c,
-	0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x76,
-	0x6f, 0x6b, 0x65, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3e, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61,
-	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x76, 0x6f,
-	0x6b, 0x65, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x9c, 0x01, 0x0a, 0x15, 0x47, 0x65, 0x74, 0x58, 0x35,
-	0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65,
-	0x12, 0x40, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
-	0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74,
-	0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x41, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f,
-	0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x58, 0x35, 0x30, 0x39, 0x41,
-	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x99, 0x01, 0x0a, 0x14, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72,
-	0x65, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x3f,
+	0x47, 0x65, 0x74, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x96, 0x01, 0x0a,
+	0x13, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f,
+	0x72, 0x69, 0x74, 0x79, 0x12, 0x3e, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74,
+	0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72,
+	0x65, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x3f, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74,
+	0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72,
+	0x65, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x99, 0x01, 0x0a, 0x14, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61,
+	0x74, 0x65, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x3f,
 	0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65,
 	0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79,
-	0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x58, 0x35, 0x30, 0x39, 0x41,
+	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4a, 0x57, 0x54, 0x41,
 	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
 	0x40, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76,
 	0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74,
-	0x79, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x58, 0x35, 0x30, 0x39,
+	0x79, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4a, 0x57, 0x54,
 	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x9c, 0x01, 0x0a, 0x15, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x58, 0x35,
-	0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x40, 0x2e, 0x73, 0x70,
-	0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c,
-	0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31,
-	0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74,
-	0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x41, 0x2e,
-	0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e,
-	0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x58, 0x35, 0x30, 0x39, 0x41,
-	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x93, 0x01, 0x0a, 0x12, 0x54, 0x61, 0x69, 0x6e, 0x74, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75,
-	0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x3d, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e,
+	0x65, 0x12, 0x90, 0x01, 0x0a, 0x11, 0x54, 0x61, 0x69, 0x6e, 0x74, 0x4a, 0x57, 0x54, 0x41, 0x75,
+	0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x3c, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e,
 	0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c,
 	0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x61, 0x69,
-	0x6e, 0x74, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3e, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61,
+	0x6e, 0x74, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3d, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75,
+	0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x61, 0x69, 0x6e, 0x74,
+	0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x93, 0x01, 0x0a, 0x12, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x4a,
+	0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x3d, 0x2e, 0x73, 0x70,
+	0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c,
+	0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31,
+	0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3e, 0x2e, 0x73, 0x70, 0x69,
+	0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f,
+	0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e,
+	0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x4a, 0x57, 0x54, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x9c, 0x01, 0x0a, 0x15, 0x47,
+	0x65, 0x74, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x12, 0x40, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74,
+	0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x58, 0x35, 0x30,
+	0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x41, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61,
 	0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61,
-	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x61, 0x69, 0x6e,
-	0x74, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x96, 0x01, 0x0a, 0x13, 0x52, 0x65, 0x76, 0x6f, 0x6b,
-	0x65, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x3e,
-	0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79,
-	0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75,
-	0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3f,
-	0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79,
-	0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75,
-	0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42,
-	0x5b, 0x5a, 0x59, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x70,
-	0x69, 0x66, 0x66, 0x65, 0x2f, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2d, 0x61, 0x70, 0x69, 0x2d, 0x73,
-	0x64, 0x6b, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2f, 0x61,
-	0x70, 0x69, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2f, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61,
-	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2f, 0x76, 0x31, 0x3b, 0x6c, 0x6f, 0x63, 0x61,
-	0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x33,
+	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x58,
+	0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x53, 0x74, 0x61, 0x74,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x99, 0x01, 0x0a, 0x14, 0x50, 0x72,
+	0x65, 0x70, 0x61, 0x72, 0x65, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x74, 0x79, 0x12, 0x3f, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f,
+	0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x58,
+	0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x40, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68,
+	0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65,
+	0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x9c, 0x01, 0x0a, 0x15, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61,
+	0x74, 0x65, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12,
+	0x40, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74,
+	0x79, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x58, 0x35, 0x30,
+	0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x41, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x58,
+	0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x93, 0x01, 0x0a, 0x12, 0x54, 0x61, 0x69, 0x6e, 0x74, 0x58, 0x35,
+	0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x3d, 0x2e, 0x73, 0x70,
+	0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c,
+	0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31,
+	0x2e, 0x54, 0x61, 0x69, 0x6e, 0x74, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3e, 0x2e, 0x73, 0x70, 0x69,
+	0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f,
+	0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e,
+	0x54, 0x61, 0x69, 0x6e, 0x74, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0xab, 0x01, 0x0a, 0x1a, 0x54,
+	0x61, 0x69, 0x6e, 0x74, 0x58, 0x35, 0x30, 0x39, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d,
+	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x45, 0x2e, 0x73, 0x70, 0x69, 0x72,
+	0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63,
+	0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x54,
+	0x61, 0x69, 0x6e, 0x74, 0x58, 0x35, 0x30, 0x39, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d,
+	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x46, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x61, 0x69, 0x6e, 0x74, 0x58, 0x35, 0x30, 0x39, 0x55,
+	0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x96, 0x01, 0x0a, 0x13, 0x52, 0x65, 0x76,
+	0x6f, 0x6b, 0x65, 0x58, 0x35, 0x30, 0x39, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79,
+	0x12, 0x3e, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x58, 0x35, 0x30, 0x39,
+	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x3f, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x58, 0x35, 0x30, 0x39,
+	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0xae, 0x01, 0x0a, 0x1b, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x58, 0x35, 0x30, 0x39,
+	0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74,
+	0x79, 0x12, 0x46, 0x2e, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x58, 0x35, 0x30,
+	0x39, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x74, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x47, 0x2e, 0x73, 0x70, 0x69, 0x72,
+	0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x6c, 0x6f, 0x63,
+	0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x76, 0x31, 0x2e, 0x52,
+	0x65, 0x76, 0x6f, 0x6b, 0x65, 0x58, 0x35, 0x30, 0x39, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61,
+	0x6d, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x42, 0x5b, 0x5a, 0x59, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x73, 0x70, 0x69, 0x66, 0x66, 0x65, 0x2f, 0x73, 0x70, 0x69, 0x72, 0x65, 0x2d, 0x61, 0x70,
+	0x69, 0x2d, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x73, 0x70, 0x69, 0x72,
+	0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2f, 0x6c, 0x6f, 0x63,
+	0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x2f, 0x76, 0x31, 0x3b, 0x6c,
+	0x6f, 0x63, 0x61, 0x6c, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x76, 0x31, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1307,45 +1517,49 @@ func file_spire_api_server_localauthority_v1_localauthority_proto_rawDescGZIP()
 	return file_spire_api_server_localauthority_v1_localauthority_proto_rawDescData
 }
 
-var file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes = make([]protoimpl.MessageInfo, 21)
+var file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes = make([]protoimpl.MessageInfo, 25)
 var file_spire_api_server_localauthority_v1_localauthority_proto_goTypes = []interface{}{
-	(*GetJWTAuthorityStateRequest)(nil),   // 0: spire.api.server.localauthority.v1.GetJWTAuthorityStateRequest
-	(*GetJWTAuthorityStateResponse)(nil),  // 1: spire.api.server.localauthority.v1.GetJWTAuthorityStateResponse
-	(*PrepareJWTAuthorityRequest)(nil),    // 2: spire.api.server.localauthority.v1.PrepareJWTAuthorityRequest
-	(*PrepareJWTAuthorityResponse)(nil),   // 3: spire.api.server.localauthority.v1.PrepareJWTAuthorityResponse
-	(*ActivateJWTAuthorityRequest)(nil),   // 4: spire.api.server.localauthority.v1.ActivateJWTAuthorityRequest
-	(*ActivateJWTAuthorityResponse)(nil),  // 5: spire.api.server.localauthority.v1.ActivateJWTAuthorityResponse
-	(*TaintJWTAuthorityRequest)(nil),      // 6: spire.api.server.localauthority.v1.TaintJWTAuthorityRequest
-	(*TaintJWTAuthorityResponse)(nil),     // 7: spire.api.server.localauthority.v1.TaintJWTAuthorityResponse
-	(*RevokeJWTAuthorityRequest)(nil),     // 8: spire.api.server.localauthority.v1.RevokeJWTAuthorityRequest
-	(*RevokeJWTAuthorityResponse)(nil),    // 9: spire.api.server.localauthority.v1.RevokeJWTAuthorityResponse
-	(*GetX509AuthorityStateRequest)(nil),  // 10: spire.api.server.localauthority.v1.GetX509AuthorityStateRequest
-	(*GetX509AuthorityStateResponse)(nil), // 11: spire.api.server.localauthority.v1.GetX509AuthorityStateResponse
-	(*PrepareX509AuthorityRequest)(nil),   // 12: spire.api.server.localauthority.v1.PrepareX509AuthorityRequest
-	(*PrepareX509AuthorityResponse)(nil),  // 13: spire.api.server.localauthority.v1.PrepareX509AuthorityResponse
-	(*ActivateX509AuthorityRequest)(nil),  // 14: spire.api.server.localauthority.v1.ActivateX509AuthorityRequest
-	(*ActivateX509AuthorityResponse)(nil), // 15: spire.api.server.localauthority.v1.ActivateX509AuthorityResponse
-	(*TaintX509AuthorityRequest)(nil),     // 16: spire.api.server.localauthority.v1.TaintX509AuthorityRequest
-	(*TaintX509AuthorityResponse)(nil),    // 17: spire.api.server.localauthority.v1.TaintX509AuthorityResponse
-	(*RevokeX509AuthorityRequest)(nil),    // 18: spire.api.server.localauthority.v1.RevokeX509AuthorityRequest
-	(*RevokeX509AuthorityResponse)(nil),   // 19: spire.api.server.localauthority.v1.RevokeX509AuthorityResponse
-	(*AuthorityState)(nil),                // 20: spire.api.server.localauthority.v1.AuthorityState
+	(*GetJWTAuthorityStateRequest)(nil),         // 0: spire.api.server.localauthority.v1.GetJWTAuthorityStateRequest
+	(*GetJWTAuthorityStateResponse)(nil),        // 1: spire.api.server.localauthority.v1.GetJWTAuthorityStateResponse
+	(*PrepareJWTAuthorityRequest)(nil),          // 2: spire.api.server.localauthority.v1.PrepareJWTAuthorityRequest
+	(*PrepareJWTAuthorityResponse)(nil),         // 3: spire.api.server.localauthority.v1.PrepareJWTAuthorityResponse
+	(*ActivateJWTAuthorityRequest)(nil),         // 4: spire.api.server.localauthority.v1.ActivateJWTAuthorityRequest
+	(*ActivateJWTAuthorityResponse)(nil),        // 5: spire.api.server.localauthority.v1.ActivateJWTAuthorityResponse
+	(*TaintJWTAuthorityRequest)(nil),            // 6: spire.api.server.localauthority.v1.TaintJWTAuthorityRequest
+	(*TaintJWTAuthorityResponse)(nil),           // 7: spire.api.server.localauthority.v1.TaintJWTAuthorityResponse
+	(*RevokeJWTAuthorityRequest)(nil),           // 8: spire.api.server.localauthority.v1.RevokeJWTAuthorityRequest
+	(*RevokeJWTAuthorityResponse)(nil),          // 9: spire.api.server.localauthority.v1.RevokeJWTAuthorityResponse
+	(*GetX509AuthorityStateRequest)(nil),        // 10: spire.api.server.localauthority.v1.GetX509AuthorityStateRequest
+	(*GetX509AuthorityStateResponse)(nil),       // 11: spire.api.server.localauthority.v1.GetX509AuthorityStateResponse
+	(*PrepareX509AuthorityRequest)(nil),         // 12: spire.api.server.localauthority.v1.PrepareX509AuthorityRequest
+	(*PrepareX509AuthorityResponse)(nil),        // 13: spire.api.server.localauthority.v1.PrepareX509AuthorityResponse
+	(*ActivateX509AuthorityRequest)(nil),        // 14: spire.api.server.localauthority.v1.ActivateX509AuthorityRequest
+	(*ActivateX509AuthorityResponse)(nil),       // 15: spire.api.server.localauthority.v1.ActivateX509AuthorityResponse
+	(*TaintX509AuthorityRequest)(nil),           // 16: spire.api.server.localauthority.v1.TaintX509AuthorityRequest
+	(*TaintX509AuthorityResponse)(nil),          // 17: spire.api.server.localauthority.v1.TaintX509AuthorityResponse
+	(*TaintX509UpstreamAuthorityRequest)(nil),   // 18: spire.api.server.localauthority.v1.TaintX509UpstreamAuthorityRequest
+	(*TaintX509UpstreamAuthorityResponse)(nil),  // 19: spire.api.server.localauthority.v1.TaintX509UpstreamAuthorityResponse
+	(*RevokeX509UpstreamAuthorityRequest)(nil),  // 20: spire.api.server.localauthority.v1.RevokeX509UpstreamAuthorityRequest
+	(*RevokeX509UpstreamAuthorityResponse)(nil), // 21: spire.api.server.localauthority.v1.RevokeX509UpstreamAuthorityResponse
+	(*RevokeX509AuthorityRequest)(nil),          // 22: spire.api.server.localauthority.v1.RevokeX509AuthorityRequest
+	(*RevokeX509AuthorityResponse)(nil),         // 23: spire.api.server.localauthority.v1.RevokeX509AuthorityResponse
+	(*AuthorityState)(nil),                      // 24: spire.api.server.localauthority.v1.AuthorityState
 }
 var file_spire_api_server_localauthority_v1_localauthority_proto_depIdxs = []int32{
-	20, // 0: spire.api.server.localauthority.v1.GetJWTAuthorityStateResponse.active:type_name -> spire.api.server.localauthority.v1.AuthorityState
-	20, // 1: spire.api.server.localauthority.v1.GetJWTAuthorityStateResponse.prepared:type_name -> spire.api.server.localauthority.v1.AuthorityState
-	20, // 2: spire.api.server.localauthority.v1.GetJWTAuthorityStateResponse.old:type_name -> spire.api.server.localauthority.v1.AuthorityState
-	20, // 3: spire.api.server.localauthority.v1.PrepareJWTAuthorityResponse.prepared_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
-	20, // 4: spire.api.server.localauthority.v1.ActivateJWTAuthorityResponse.activated_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
-	20, // 5: spire.api.server.localauthority.v1.TaintJWTAuthorityResponse.tainted_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
-	20, // 6: spire.api.server.localauthority.v1.RevokeJWTAuthorityResponse.revoked_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
-	20, // 7: spire.api.server.localauthority.v1.GetX509AuthorityStateResponse.active:type_name -> spire.api.server.localauthority.v1.AuthorityState
-	20, // 8: spire.api.server.localauthority.v1.GetX509AuthorityStateResponse.prepared:type_name -> spire.api.server.localauthority.v1.AuthorityState
-	20, // 9: spire.api.server.localauthority.v1.GetX509AuthorityStateResponse.old:type_name -> spire.api.server.localauthority.v1.AuthorityState
-	20, // 10: spire.api.server.localauthority.v1.PrepareX509AuthorityResponse.prepared_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
-	20, // 11: spire.api.server.localauthority.v1.ActivateX509AuthorityResponse.activated_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
-	20, // 12: spire.api.server.localauthority.v1.TaintX509AuthorityResponse.tainted_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
-	20, // 13: spire.api.server.localauthority.v1.RevokeX509AuthorityResponse.revoked_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 0: spire.api.server.localauthority.v1.GetJWTAuthorityStateResponse.active:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 1: spire.api.server.localauthority.v1.GetJWTAuthorityStateResponse.prepared:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 2: spire.api.server.localauthority.v1.GetJWTAuthorityStateResponse.old:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 3: spire.api.server.localauthority.v1.PrepareJWTAuthorityResponse.prepared_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 4: spire.api.server.localauthority.v1.ActivateJWTAuthorityResponse.activated_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 5: spire.api.server.localauthority.v1.TaintJWTAuthorityResponse.tainted_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 6: spire.api.server.localauthority.v1.RevokeJWTAuthorityResponse.revoked_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 7: spire.api.server.localauthority.v1.GetX509AuthorityStateResponse.active:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 8: spire.api.server.localauthority.v1.GetX509AuthorityStateResponse.prepared:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 9: spire.api.server.localauthority.v1.GetX509AuthorityStateResponse.old:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 10: spire.api.server.localauthority.v1.PrepareX509AuthorityResponse.prepared_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 11: spire.api.server.localauthority.v1.ActivateX509AuthorityResponse.activated_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 12: spire.api.server.localauthority.v1.TaintX509AuthorityResponse.tainted_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
+	24, // 13: spire.api.server.localauthority.v1.RevokeX509AuthorityResponse.revoked_authority:type_name -> spire.api.server.localauthority.v1.AuthorityState
 	0,  // 14: spire.api.server.localauthority.v1.LocalAuthority.GetJWTAuthorityState:input_type -> spire.api.server.localauthority.v1.GetJWTAuthorityStateRequest
 	2,  // 15: spire.api.server.localauthority.v1.LocalAuthority.PrepareJWTAuthority:input_type -> spire.api.server.localauthority.v1.PrepareJWTAuthorityRequest
 	4,  // 16: spire.api.server.localauthority.v1.LocalAuthority.ActivateJWTAuthority:input_type -> spire.api.server.localauthority.v1.ActivateJWTAuthorityRequest
@@ -1355,19 +1569,23 @@ var file_spire_api_server_localauthority_v1_localauthority_proto_depIdxs = []int
 	12, // 20: spire.api.server.localauthority.v1.LocalAuthority.PrepareX509Authority:input_type -> spire.api.server.localauthority.v1.PrepareX509AuthorityRequest
 	14, // 21: spire.api.server.localauthority.v1.LocalAuthority.ActivateX509Authority:input_type -> spire.api.server.localauthority.v1.ActivateX509AuthorityRequest
 	16, // 22: spire.api.server.localauthority.v1.LocalAuthority.TaintX509Authority:input_type -> spire.api.server.localauthority.v1.TaintX509AuthorityRequest
-	18, // 23: spire.api.server.localauthority.v1.LocalAuthority.RevokeX509Authority:input_type -> spire.api.server.localauthority.v1.RevokeX509AuthorityRequest
-	1,  // 24: spire.api.server.localauthority.v1.LocalAuthority.GetJWTAuthorityState:output_type -> spire.api.server.localauthority.v1.GetJWTAuthorityStateResponse
-	3,  // 25: spire.api.server.localauthority.v1.LocalAuthority.PrepareJWTAuthority:output_type -> spire.api.server.localauthority.v1.PrepareJWTAuthorityResponse
-	5,  // 26: spire.api.server.localauthority.v1.LocalAuthority.ActivateJWTAuthority:output_type -> spire.api.server.localauthority.v1.ActivateJWTAuthorityResponse
-	7,  // 27: spire.api.server.localauthority.v1.LocalAuthority.TaintJWTAuthority:output_type -> spire.api.server.localauthority.v1.TaintJWTAuthorityResponse
-	9,  // 28: spire.api.server.localauthority.v1.LocalAuthority.RevokeJWTAuthority:output_type -> spire.api.server.localauthority.v1.RevokeJWTAuthorityResponse
-	11, // 29: spire.api.server.localauthority.v1.LocalAuthority.GetX509AuthorityState:output_type -> spire.api.server.localauthority.v1.GetX509AuthorityStateResponse
-	13, // 30: spire.api.server.localauthority.v1.LocalAuthority.PrepareX509Authority:output_type -> spire.api.server.localauthority.v1.PrepareX509AuthorityResponse
-	15, // 31: spire.api.server.localauthority.v1.LocalAuthority.ActivateX509Authority:output_type -> spire.api.server.localauthority.v1.ActivateX509AuthorityResponse
-	17, // 32: spire.api.server.localauthority.v1.LocalAuthority.TaintX509Authority:output_type -> spire.api.server.localauthority.v1.TaintX509AuthorityResponse
-	19, // 33: spire.api.server.localauthority.v1.LocalAuthority.RevokeX509Authority:output_type -> spire.api.server.localauthority.v1.RevokeX509AuthorityResponse
-	24, // [24:34] is the sub-list for method output_type
-	14, // [14:24] is the sub-list for method input_type
+	18, // 23: spire.api.server.localauthority.v1.LocalAuthority.TaintX509UpstreamAuthority:input_type -> spire.api.server.localauthority.v1.TaintX509UpstreamAuthorityRequest
+	22, // 24: spire.api.server.localauthority.v1.LocalAuthority.RevokeX509Authority:input_type -> spire.api.server.localauthority.v1.RevokeX509AuthorityRequest
+	20, // 25: spire.api.server.localauthority.v1.LocalAuthority.RevokeX509UpstreamAuthority:input_type -> spire.api.server.localauthority.v1.RevokeX509UpstreamAuthorityRequest
+	1,  // 26: spire.api.server.localauthority.v1.LocalAuthority.GetJWTAuthorityState:output_type -> spire.api.server.localauthority.v1.GetJWTAuthorityStateResponse
+	3,  // 27: spire.api.server.localauthority.v1.LocalAuthority.PrepareJWTAuthority:output_type -> spire.api.server.localauthority.v1.PrepareJWTAuthorityResponse
+	5,  // 28: spire.api.server.localauthority.v1.LocalAuthority.ActivateJWTAuthority:output_type -> spire.api.server.localauthority.v1.ActivateJWTAuthorityResponse
+	7,  // 29: spire.api.server.localauthority.v1.LocalAuthority.TaintJWTAuthority:output_type -> spire.api.server.localauthority.v1.TaintJWTAuthorityResponse
+	9,  // 30: spire.api.server.localauthority.v1.LocalAuthority.RevokeJWTAuthority:output_type -> spire.api.server.localauthority.v1.RevokeJWTAuthorityResponse
+	11, // 31: spire.api.server.localauthority.v1.LocalAuthority.GetX509AuthorityState:output_type -> spire.api.server.localauthority.v1.GetX509AuthorityStateResponse
+	13, // 32: spire.api.server.localauthority.v1.LocalAuthority.PrepareX509Authority:output_type -> spire.api.server.localauthority.v1.PrepareX509AuthorityResponse
+	15, // 33: spire.api.server.localauthority.v1.LocalAuthority.ActivateX509Authority:output_type -> spire.api.server.localauthority.v1.ActivateX509AuthorityResponse
+	17, // 34: spire.api.server.localauthority.v1.LocalAuthority.TaintX509Authority:output_type -> spire.api.server.localauthority.v1.TaintX509AuthorityResponse
+	19, // 35: spire.api.server.localauthority.v1.LocalAuthority.TaintX509UpstreamAuthority:output_type -> spire.api.server.localauthority.v1.TaintX509UpstreamAuthorityResponse
+	23, // 36: spire.api.server.localauthority.v1.LocalAuthority.RevokeX509Authority:output_type -> spire.api.server.localauthority.v1.RevokeX509AuthorityResponse
+	21, // 37: spire.api.server.localauthority.v1.LocalAuthority.RevokeX509UpstreamAuthority:output_type -> spire.api.server.localauthority.v1.RevokeX509UpstreamAuthorityResponse
+	26, // [26:38] is the sub-list for method output_type
+	14, // [14:26] is the sub-list for method input_type
 	14, // [14:14] is the sub-list for extension type_name
 	14, // [14:14] is the sub-list for extension extendee
 	0,  // [0:14] is the sub-list for field type_name
@@ -1596,7 +1814,7 @@ func file_spire_api_server_localauthority_v1_localauthority_proto_init() {
 			}
 		}
 		file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RevokeX509AuthorityRequest); i {
+			switch v := v.(*TaintX509UpstreamAuthorityRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1608,7 +1826,7 @@ func file_spire_api_server_localauthority_v1_localauthority_proto_init() {
 			}
 		}
 		file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RevokeX509AuthorityResponse); i {
+			switch v := v.(*TaintX509UpstreamAuthorityResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1620,6 +1838,54 @@ func file_spire_api_server_localauthority_v1_localauthority_proto_init() {
 			}
 		}
 		file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RevokeX509UpstreamAuthorityRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RevokeX509UpstreamAuthorityResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RevokeX509AuthorityRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RevokeX509AuthorityResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_spire_api_server_localauthority_v1_localauthority_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*AuthorityState); i {
 			case 0:
 				return &v.state
@@ -1638,7 +1904,7 @@ func file_spire_api_server_localauthority_v1_localauthority_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_spire_api_server_localauthority_v1_localauthority_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   21,
+			NumMessages:   25,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/proto/spire/api/server/localauthority/v1/localauthority.proto b/proto/spire/api/server/localauthority/v1/localauthority.proto
index df29792..1c088d9 100644
--- a/proto/spire/api/server/localauthority/v1/localauthority.proto
+++ b/proto/spire/api/server/localauthority/v1/localauthority.proto
@@ -62,13 +62,31 @@ service LocalAuthority {
         // will perform proactive rotations of any key material related to
         // the tainted authority. The result of this action will be observed
         // cluster-wide.
-        // It can receive the public key of an old X.509 authority.
+        // The X.509 authority to taint is identified using the provided X.509 Subject Key
+	// 
+	// If an upstream authority is configured then local authorities cannot be tainted,
+	// and a FailedPrecondition error will be returned.
         //
         // If a previously active X.509 authority does not exist (e.g. if one
         // has been prepared but not activated yet), a FailedPrecondition
         // error will be returned.
         rpc TaintX509Authority(TaintX509AuthorityRequest) returns (TaintX509AuthorityResponse);
 
+        // TaintX509UpstreamAuthority marks the provided upstream authority as
+        // being tainted. SPIRE Agents observing a tainted authority
+        // will perform proactive rotations of any key material related to
+        // the tainted authority. The result of this action will be observed
+        // cluster-wide.
+	// It is important to change to a new active upstream authority before tainting the old one,
+	// since tainting will force the rotation of any bundle that is using
+	// the old upstream authority.
+	// The X.509 authority to taint is identified using the provided X.509 Subject Key
+	// Identifier (or SKID) of the old X.509 authority.
+        //
+        // If an X.509 upstream authority is not configured, or the identified upstream
+	// X.509 authority is active, a FailedPrecondition error will be returned.
+        rpc TaintX509UpstreamAuthority(TaintX509UpstreamAuthorityRequest) returns (TaintX509UpstreamAuthorityResponse);
+
         // RevokeX509Authority revokes the previously active X.509 authority by
         // removing it from the bundle and propagating this update throughout
         // the cluster.
@@ -78,6 +96,16 @@ service LocalAuthority {
         // has been prepared but not activated yet), a FailedPrecondition
         // error will be returned.
         rpc RevokeX509Authority(RevokeX509AuthorityRequest) returns (RevokeX509AuthorityResponse);
+
+        // RevokeX509UpstreamAuthority revokes the previously active X.509 upstream authority by
+        // removing it from the bundle and propagating this update throughout
+        // the cluster.
+	// The X.509 authority to revoke is identified using the provided subject key ID of
+	// the authority's CA certificate.
+        //
+        // If a previously active X.509 upstream authority does not exist, a FailedPrecondition
+        // error will be returned.
+        rpc RevokeX509UpstreamAuthority(RevokeX509UpstreamAuthorityRequest) returns (RevokeX509UpstreamAuthorityResponse);
 }
 
 message GetJWTAuthorityStateRequest {}
@@ -179,6 +207,24 @@ message TaintX509AuthorityResponse {
         AuthorityState tainted_authority = 1;
 }
 
+message TaintX509UpstreamAuthorityRequest {
+        // This is the X.509 Subject Key Identifier (or SKID) of the
+        // authority's CA certificate of the upstream X.509 authority to taint.
+        string subject_key_id = 1;
+}
+
+message TaintX509UpstreamAuthorityResponse {
+}
+
+message RevokeX509UpstreamAuthorityRequest {
+        // This is the X.509 Subject Key Identifier (or SKID) of the
+        // authority's CA certificate of the upstream X.509 authority to revoke.
+        string subject_key_id = 1;
+}
+
+message RevokeX509UpstreamAuthorityResponse {
+}
+
 message RevokeX509AuthorityRequest {
         // Optional. The authority ID of the local X.509 authority to revoke.
         // This is the X.509 Subject Key Identifier (or SKID) of the
diff --git a/proto/spire/api/server/localauthority/v1/localauthority_grpc.pb.go b/proto/spire/api/server/localauthority/v1/localauthority_grpc.pb.go
index 739ee0e..5acc241 100644
--- a/proto/spire/api/server/localauthority/v1/localauthority_grpc.pb.go
+++ b/proto/spire/api/server/localauthority/v1/localauthority_grpc.pb.go
@@ -66,12 +66,29 @@ type LocalAuthorityClient interface {
 	// will perform proactive rotations of any key material related to
 	// the tainted authority. The result of this action will be observed
 	// cluster-wide.
-	// It can receive the public key of an old X.509 authority.
+	// The X.509 authority to taint is identified using the provided X.509 Subject Key
+	//
+	// If an upstream authority is configured then local authorities cannot be tainted,
+	// and a FailedPrecondition error will be returned.
 	//
 	// If a previously active X.509 authority does not exist (e.g. if one
 	// has been prepared but not activated yet), a FailedPrecondition
 	// error will be returned.
 	TaintX509Authority(ctx context.Context, in *TaintX509AuthorityRequest, opts ...grpc.CallOption) (*TaintX509AuthorityResponse, error)
+	// TaintX509UpstreamAuthority marks the provided upstream authority as
+	// being tainted. SPIRE Agents observing a tainted authority
+	// will perform proactive rotations of any key material related to
+	// the tainted authority. The result of this action will be observed
+	// cluster-wide.
+	// It is important to change to a new active upstream authority before tainting the old one,
+	// since tainting will force the rotation of any bundle that is using
+	// the old upstream authority.
+	// The X.509 authority to taint is identified using the provided X.509 Subject Key
+	// Identifier (or SKID) of the old X.509 authority.
+	//
+	// If an X.509 upstream authority is not configured, or the identified upstream
+	// X.509 authority is active, a FailedPrecondition error will be returned.
+	TaintX509UpstreamAuthority(ctx context.Context, in *TaintX509UpstreamAuthorityRequest, opts ...grpc.CallOption) (*TaintX509UpstreamAuthorityResponse, error)
 	// RevokeX509Authority revokes the previously active X.509 authority by
 	// removing it from the bundle and propagating this update throughout
 	// the cluster.
@@ -81,6 +98,15 @@ type LocalAuthorityClient interface {
 	// has been prepared but not activated yet), a FailedPrecondition
 	// error will be returned.
 	RevokeX509Authority(ctx context.Context, in *RevokeX509AuthorityRequest, opts ...grpc.CallOption) (*RevokeX509AuthorityResponse, error)
+	// RevokeX509UpstreamAuthority revokes the previously active X.509 upstream authority by
+	// removing it from the bundle and propagating this update throughout
+	// the cluster.
+	// The X.509 authority to revoke is identified using the provided subject key ID of
+	// the authority's CA certificate.
+	//
+	// If a previously active X.509 upstream authority does not exist, a FailedPrecondition
+	// error will be returned.
+	RevokeX509UpstreamAuthority(ctx context.Context, in *RevokeX509UpstreamAuthorityRequest, opts ...grpc.CallOption) (*RevokeX509UpstreamAuthorityResponse, error)
 }
 
 type localAuthorityClient struct {
@@ -172,6 +198,15 @@ func (c *localAuthorityClient) TaintX509Authority(ctx context.Context, in *Taint
 	return out, nil
 }
 
+func (c *localAuthorityClient) TaintX509UpstreamAuthority(ctx context.Context, in *TaintX509UpstreamAuthorityRequest, opts ...grpc.CallOption) (*TaintX509UpstreamAuthorityResponse, error) {
+	out := new(TaintX509UpstreamAuthorityResponse)
+	err := c.cc.Invoke(ctx, "/spire.api.server.localauthority.v1.LocalAuthority/TaintX509UpstreamAuthority", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *localAuthorityClient) RevokeX509Authority(ctx context.Context, in *RevokeX509AuthorityRequest, opts ...grpc.CallOption) (*RevokeX509AuthorityResponse, error) {
 	out := new(RevokeX509AuthorityResponse)
 	err := c.cc.Invoke(ctx, "/spire.api.server.localauthority.v1.LocalAuthority/RevokeX509Authority", in, out, opts...)
@@ -181,6 +216,15 @@ func (c *localAuthorityClient) RevokeX509Authority(ctx context.Context, in *Revo
 	return out, nil
 }
 
+func (c *localAuthorityClient) RevokeX509UpstreamAuthority(ctx context.Context, in *RevokeX509UpstreamAuthorityRequest, opts ...grpc.CallOption) (*RevokeX509UpstreamAuthorityResponse, error) {
+	out := new(RevokeX509UpstreamAuthorityResponse)
+	err := c.cc.Invoke(ctx, "/spire.api.server.localauthority.v1.LocalAuthority/RevokeX509UpstreamAuthority", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // LocalAuthorityServer is the server API for LocalAuthority service.
 // All implementations must embed UnimplementedLocalAuthorityServer
 // for forward compatibility
@@ -234,12 +278,29 @@ type LocalAuthorityServer interface {
 	// will perform proactive rotations of any key material related to
 	// the tainted authority. The result of this action will be observed
 	// cluster-wide.
-	// It can receive the public key of an old X.509 authority.
+	// The X.509 authority to taint is identified using the provided X.509 Subject Key
+	//
+	// If an upstream authority is configured then local authorities cannot be tainted,
+	// and a FailedPrecondition error will be returned.
 	//
 	// If a previously active X.509 authority does not exist (e.g. if one
 	// has been prepared but not activated yet), a FailedPrecondition
 	// error will be returned.
 	TaintX509Authority(context.Context, *TaintX509AuthorityRequest) (*TaintX509AuthorityResponse, error)
+	// TaintX509UpstreamAuthority marks the provided upstream authority as
+	// being tainted. SPIRE Agents observing a tainted authority
+	// will perform proactive rotations of any key material related to
+	// the tainted authority. The result of this action will be observed
+	// cluster-wide.
+	// It is important to change to a new active upstream authority before tainting the old one,
+	// since tainting will force the rotation of any bundle that is using
+	// the old upstream authority.
+	// The X.509 authority to taint is identified using the provided X.509 Subject Key
+	// Identifier (or SKID) of the old X.509 authority.
+	//
+	// If an X.509 upstream authority is not configured, or the identified upstream
+	// X.509 authority is active, a FailedPrecondition error will be returned.
+	TaintX509UpstreamAuthority(context.Context, *TaintX509UpstreamAuthorityRequest) (*TaintX509UpstreamAuthorityResponse, error)
 	// RevokeX509Authority revokes the previously active X.509 authority by
 	// removing it from the bundle and propagating this update throughout
 	// the cluster.
@@ -249,6 +310,15 @@ type LocalAuthorityServer interface {
 	// has been prepared but not activated yet), a FailedPrecondition
 	// error will be returned.
 	RevokeX509Authority(context.Context, *RevokeX509AuthorityRequest) (*RevokeX509AuthorityResponse, error)
+	// RevokeX509UpstreamAuthority revokes the previously active X.509 upstream authority by
+	// removing it from the bundle and propagating this update throughout
+	// the cluster.
+	// The X.509 authority to revoke is identified using the provided subject key ID of
+	// the authority's CA certificate.
+	//
+	// If a previously active X.509 upstream authority does not exist, a FailedPrecondition
+	// error will be returned.
+	RevokeX509UpstreamAuthority(context.Context, *RevokeX509UpstreamAuthorityRequest) (*RevokeX509UpstreamAuthorityResponse, error)
 	mustEmbedUnimplementedLocalAuthorityServer()
 }
 
@@ -283,9 +353,15 @@ func (UnimplementedLocalAuthorityServer) ActivateX509Authority(context.Context,
 func (UnimplementedLocalAuthorityServer) TaintX509Authority(context.Context, *TaintX509AuthorityRequest) (*TaintX509AuthorityResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method TaintX509Authority not implemented")
 }
+func (UnimplementedLocalAuthorityServer) TaintX509UpstreamAuthority(context.Context, *TaintX509UpstreamAuthorityRequest) (*TaintX509UpstreamAuthorityResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method TaintX509UpstreamAuthority not implemented")
+}
 func (UnimplementedLocalAuthorityServer) RevokeX509Authority(context.Context, *RevokeX509AuthorityRequest) (*RevokeX509AuthorityResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method RevokeX509Authority not implemented")
 }
+func (UnimplementedLocalAuthorityServer) RevokeX509UpstreamAuthority(context.Context, *RevokeX509UpstreamAuthorityRequest) (*RevokeX509UpstreamAuthorityResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RevokeX509UpstreamAuthority not implemented")
+}
 func (UnimplementedLocalAuthorityServer) mustEmbedUnimplementedLocalAuthorityServer() {}
 
 // UnsafeLocalAuthorityServer may be embedded to opt out of forward compatibility for this service.
@@ -461,6 +537,24 @@ func _LocalAuthority_TaintX509Authority_Handler(srv interface{}, ctx context.Con
 	return interceptor(ctx, in, info, handler)
 }
 
+func _LocalAuthority_TaintX509UpstreamAuthority_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TaintX509UpstreamAuthorityRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(LocalAuthorityServer).TaintX509UpstreamAuthority(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/spire.api.server.localauthority.v1.LocalAuthority/TaintX509UpstreamAuthority",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(LocalAuthorityServer).TaintX509UpstreamAuthority(ctx, req.(*TaintX509UpstreamAuthorityRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _LocalAuthority_RevokeX509Authority_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(RevokeX509AuthorityRequest)
 	if err := dec(in); err != nil {
@@ -479,6 +573,24 @@ func _LocalAuthority_RevokeX509Authority_Handler(srv interface{}, ctx context.Co
 	return interceptor(ctx, in, info, handler)
 }
 
+func _LocalAuthority_RevokeX509UpstreamAuthority_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RevokeX509UpstreamAuthorityRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(LocalAuthorityServer).RevokeX509UpstreamAuthority(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/spire.api.server.localauthority.v1.LocalAuthority/RevokeX509UpstreamAuthority",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(LocalAuthorityServer).RevokeX509UpstreamAuthority(ctx, req.(*RevokeX509UpstreamAuthorityRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 var _LocalAuthority_serviceDesc = grpc.ServiceDesc{
 	ServiceName: "spire.api.server.localauthority.v1.LocalAuthority",
 	HandlerType: (*LocalAuthorityServer)(nil),
@@ -519,10 +631,18 @@ var _LocalAuthority_serviceDesc = grpc.ServiceDesc{
 			MethodName: "TaintX509Authority",
 			Handler:    _LocalAuthority_TaintX509Authority_Handler,
 		},
+		{
+			MethodName: "TaintX509UpstreamAuthority",
+			Handler:    _LocalAuthority_TaintX509UpstreamAuthority_Handler,
+		},
 		{
 			MethodName: "RevokeX509Authority",
 			Handler:    _LocalAuthority_RevokeX509Authority_Handler,
 		},
+		{
+			MethodName: "RevokeX509UpstreamAuthority",
+			Handler:    _LocalAuthority_RevokeX509UpstreamAuthority_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "spire/api/server/localauthority/v1/localauthority.proto",