CAs aren’t exactly as bulletproof as you seem to think they are, and mess things up quite often, despite playing an easier game. Easier because a properly run

CAs aren’t exactly as bulletproof as you seem to think they are, and mess things up quite often, despite playing an easier game. Easier because a properly run CA doesn’t hold the private keys for all certificates it has ever issued, so key theft allows you to sign new certs and impersonate people, but it doesn’t allow you to passively eavesdrop on encrypted communications, or decrypt old messages — forward secrecy holds. Easier because there is a trust structure where certificates can be revoked. We can revoke wrongly issued certificates and the compromised signing keys, and we have contained the damage. Compare and contrast this proposal, where there is no mechanism to secure phones in the wild once their keys leak.