(I work for Guardtime.) KSI verification is meant to be decentralised; that is, no single (centralised) entity should have the ability to, for example, create fake timestamps. You can deploy KSI in various ways, so there can be, for example, one entity who controls access to the blockchain (but for example they still cannot fake any evidence).

Right, it appears you can have multiple physical tamper-protected boxes that agree with each other, which makes it federated, but not decentralized.

I tend to subscribe to the definitions laid out in the following article:

https://blog.ethereum.org/2015/08/07/on-public-and-private-b...