Comment by woodruffw
17 hours ago
Why would I trust my domain registrar to maintain PKI? They don’t seem inherently better suited for it, and in various ways are more susceptible to meddling for e.g. ccTLDs.
I think the idea that CAs are uniquely incompetent is probably incorrect.
> I think the idea that CAs are uniquely incompetent is probably incorrect.
The problem with the certificate authority system is that any CA can sign a cert for any domain name. It only takes 1 incompetent or malicious CA to break the whole system wide open. And there are so many CAs that inevitably some of them are incompetent, and use keys like 7. And some are definitely in bed with a government you don't like.
Moving certs into DNS means we only have to trust the registrars. Not the registrars AND the huge set of CAs.