Comment by VorpalWay
16 hours ago
You could store the public key for each website in DNS. But now you moved the trust problem to DNSSEC. So far I haven't heard about issues like this for DNSSEC, but then again it is not a massive target currently.
16 hours ago
You could store the public key for each website in DNS. But now you moved the trust problem to DNSSEC. So far I haven't heard about issues like this for DNSSEC, but then again it is not a massive target currently.
DNSSEC has the inherent advantage that only the root servers could have the same impact as any CA dpes mow because anything below them has much more limited scope. And any software that is reasonably updated can just pin the DNSSEC keys for TLDs and then you have no single entity with global fuck up potential.
It's also worth remembering that domain validated CA certificates already rely on trusting the DNS hierarchy as the source of the information they certify.
CAs themselves already trust DNS to verify your domain.