Comment by sylware
11 hours ago
The CA concept itself is flawed, unless normal users were able to cherry pick the CA they do trust, dream. And even with that, they must keep in mind that many authorities and/or mafias have very probably rogue certificates for browser invisible man-in-the-middle.
It's an interesting idea, but how would a user make that decision on who to trust? As in, what 'things' could we look at to make that call?
Doesn't ACME+CT solve this threat?