I reluctantly stopped all usage and recommendation of StartSSL last year after concerning information came up about a shift to Chinese ownership/control due to

I reluctantly stopped all usage and recommendation of StartSSL last year after concerning information came up about a shift to Chinese ownership/control due to their hosting by Qihoo 360 (previous discussed on HN [1]), which went poorly in the context of both their lack of transparency and their long standing insistence that certain keys be generated in the browser rather then a user supplied CSR. But it really was reluctant because their actual model was fantastic and how I desperately wish other CAs operated. They charged only for the actions that actually take human time: manual identity verification. Machine verification was always free, but then there was the option to get basic identity verified for a reasonable price (getting a level 2 cert), then an organization, and then a more extensive organization verification. At each step once you had a given level of verification done you could then get certs without further payment for the validity period, in stark contrast to the artificial expense CAs normally add. In an ideal world cryptographic authentication would be part of the standard services offered by government, and in fact authentication should be a core function of government period, but that is not the case. And no, Let's Encrypt is not a full substitute unfortunately, as it offers only SSL certs. GPG has poor mobile and native platform support compared S/MIME. So I do think it's a bummer that StartCom is toast. [1]: https://news.ycombinator.com/item?id=11107740 https://news.ycombinator.com/item?id=11107740 Edited to add: just to be clear, they absolutely had their flaws all along too, primarily in terms of charging for revocations which rightly earned criticism. But I still wish a better organization would take the good bits and improve rather then the entire thing vanishing into the annals of history. I feel like we're really treading water when it comes to authentication, despite it being an ever more critical part of life. All the math and basic tech needed to solve it correctly and in a user friendly way has been around for at least a decade or two at this point, yet most people and organizations still send messages with no real authentication (which in turn is the direct root of much spam and scams), password use (and resultant problems) is still near universal standard practice, etc.