> This is the first I've heard about SPKI being an Internet-scale answer to the problem of X.509. You're not the only one, and that's the problem. It has been

> This is the first I've heard about SPKI being an Internet-scale answer to the problem of X.509. You're not the only one, and that's the problem. It has been, for nearly twenty years now. > The problem with the CA system isn't technical (even though X.509 truly does suck), but institutional: you can't have a single central authority handling all of Internet trust (it doesn't scale well, and it [rightfully!] alarms people), but if you have more then one, a market forms and generates a race to the bottom. The problem is that we already have a single point of truth: ICANN. And the problem is that we have multiple points of truth: every single CA out there is trusted for the entire Internet. If you trust letsencrypt, you ultimately rely on ICANN. If you trust StartSSL, you ultimately rely on ICANN. The virtue of SPKI is that it forces one to be honest with oneself. The owner of com really does own every single hostname under com; why not be honest about that? The owner of cn really does own every single hostname under cn; why not be honest about that? Why create a system where entities who can be legally compelled by any two-bit nation-state which can pay for a guy with a rubber hose are trusted for the entire world, rather than only for their two-bit nation-states? Government-controlled PKI doesn't bother me, because ultimately every PKI is controlled by governments, because governments have a monopoly on force. AC Camerfirma S.A. is in my certstore; they are a firm in the Kingdom of Spain, and the King or any of his government are at liberty to compel AC Camerfirma S.A. to produce a certificate for google.com or news.ycombinator.com at any time they wish. So I am trusting the King of Spain and his government with the security of my connexion to Google, an Alphabet company with servers located in the U.S. That's … insane. Per your article's comment, 'Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled BIT.LY’s TLS keys': Gaddafi did ultimately control bit.ly's TLS keys, as indicated in 2010 when his government shut down vb.ly. They could have, had they wished, pointed that domain name at servers they controlled and requested a StartSSL certificate; today they could do the same for a letsencrypt cert. DNSSEC is probably a mistake for other reasons, but a SPKI-based system in which hosts received certificates from their domain name providers, from their IP address providers and from their legal places of registration would have been superior to our current system, in which any host may be certified by any CA anywhere.