It's more a problem of certificate chain trust models. You have to trust the security of every podunk CA in your browser's root store since they all have the ab

It's more a problem of certificate chain trust models. You have to trust the security of every podunk CA in your browser's root store since they all have the ability to sign anyone in the world's cert. Should the government CA of Taiwan have the ability to sign bofa.com? I would say no. Let them have * .tw. The funny thing is that x509 has the ability to limit signing to various CNs, so it's possible to limit signing powers, but no one seems to do it. > The alternatives are worse. Hardly. Some alternatives might be worse (plaintext everywhere, for instance). What I would like to see is a * .example.com signing cert being given to all domain owners when they buy a domain, signed by a single * .com authority (or .net or whatever the domain is). This would prove to the https client that the domain they are connecting to is really the domain owner. This is a basic level of trust that would be an option for everyone who owns a domain (without any stupid yearly charge for the certs). Banks and other important sites could go above and beyond and buy certs that verify that their business is what they say it is, which is another trust level entirely (this already exists and can be seen when you go to paypal.com in firefox and get the green location bar thing). I think that would be a much better alternative than our current system.