> I bet the answer is "possible but not easy". I would bet the same. This seems like what you want for an exemption process: if it's too easy, people will use

> I bet the answer is "possible but not easy". I would bet the same. This seems like what you want for an exemption process: if it's too easy, people will use exemptions rather than fixing an underlying problem. > someone's personal blog needs to have the same level of security as the apple app store's payment system Different grades of security would not have helped in this case, because it was payment systems having trouble updating, and we put anything involving money on a high security tier - except when legacy systems get an exception. It's not quite one-size-fits-all, because EV certificates are meant to show more trust, and most banks etc. will use those. That takes extra work, which isn't worth it for a personal site. But you don't save any work by using a weaker hash algorithm, so there's no reason for a personal blog to do so. > the CAB chose to inflict a ton of pain and cause still-functioning hardware to be discarded It does sound like they should have had an exemption process set up before the cutoff date, or put the cutoff further out to give people more time to upgrade systems. But using Hanlon's razor, it was probably an oversight rather than deliberate 'environmental vandalism'.