Comment by VorpalWay
15 hours ago
Honestly, why would we need anything except LE for TLS certs? Sure, they don't issue EV certs, but isn't that completely dead by now anyway?
You could argue single point of failure, which is fair, so then set up another LE clone which is run in a similar way in another (reasonable) country.
(And there is of course non TLS certs, such as code signing and S/MIME, if that is still a thing. I'm only arguing about the TLS case here.)
Personally? I'd agree with you. FWIW, you already have to trust your browser vendor, so you might as well trust Mozilla and Google and Apple and MSFT who can spin up one each, or collectively two or three CAs in US, UK, Switzerland, Ireland or sth like that.
That said, starting from the status quo, not sure that's the path of least resistance to get there.