Comment by ipdashc
17 hours ago
> and half the world that does pin is probably pinned to Let's Encrypt
To be fair, unless I'm misunderstanding, wouldn't this be a good move?
LE has a good security record and takes itself seriously, versus these smaller CAs that seem to mess up regularly.
All your eggs end up in one basket usually because it's a really good basket.
All things turn and curve and degrade; Google used to be the "it's perfect" darling.
Interesting to mention Google because the whole system still relies on them. They decide what certificate transparency logs can enter the program and offer the list of logs. If you don't trust Google web PKI falls apart.