> there is no need to use SSL; instead, you can distribute the server's public RSA key (or its hash) along with the client code Imagine the following scenario:

> there is no need to use SSL; instead, you can distribute the server's public RSA key (or its hash) along with the client code Imagine the following scenario: All the hard negotiations are done and you're about to sign your biggest customer or even sell the entire business for big bux. This is, of course, contingent on a clean 3rd party security review. The reviewer asks: "How does the system enforce key expiration policies? How do you rotate keys? How do you revoke a key that may have been compromised or recover from known compromise? Which private keys get used on network-facing servers? In what model of HSM do you store the root key?" ... and so on.