> The reason it doesn't is that if you get a CA to issue a bogus Google Mail request for surveillance purposes, Google will put your CA out of business. Will i

> The reason it doesn't is that if you get a CA to issue a bogus Google Mail request for surveillance purposes, Google will put your CA out of business. Will it? If the USG orders Symantec to issue a bogus certificate, will Microsoft, Apple, Google, Mozilla & Opera all refuse to accept Symantec certs? If the PRC orders CNNIC to issue a bogus certificate, will they all refuse to accept CNNIC certs? I grant you that they could; I just don't think it's very likely. Sure, DigiNotar was put out of our misery, but it was small and marginal. I agree with you on the crypto of DNSSEC. Where I disagree is that there is any meaningful ownership structure of DNS names other than … the DNS hierarchy. DNS is feudal: the holder of foo.bar holds it at the pleasure of the owner of bar; the holder of quux.foo.bar holds it at the pleasure of both foo.bar & bar. Ignoring those facts is IMHO silly, and forces sloppy thinking. People want multiple things out of the CA system, which is part of why it's so terrible. One of those is tying hosts to real-life identities. DNSSEC is indeed terrible at that. Another is tying hosts to hostnames; DNSSEC at least attempts to do that (as you note, not terribly well, although maybe it's fixable).