It's too easy to get certs into the root store of most distros, which means they're not practically usable for secure communication. There's often no auditing o

It's too easy to get certs into the root store of most distros, which means they're not practically usable for secure communication. There's often no auditing of the CAs to ensure they are taking due care to minimise risk of a bogus certificate being issued. [1] To be fair, some things have improved: Debian (and maybe Ubuntu) now have the Mozilla trust store plus one additional root (SPI). That said, all you need is one bad actor for the system to fail, and it seems the only reason why SPI is there is Debian infrastructure relies on it—but that doesn't make SPI trustworthy. [2] [1]: https://plus.google.com/105761279104103278252/posts/eVdB6X3NpPg https://plus.google.com/105761279104103278252/posts/eVdB6X3N... [2]: http://anonscm.debian.org/gitweb/?p=collab-maint/ca-certificates.git;a=blob;f=debian/README.Debian http://anonscm.debian.org/gitweb/?p=collab-maint/ca-certific...