3 ms·
True. They should maybe consider breaking up their operation into 20 or so root certs.
by sam0x17 8y ago
True. They should maybe consider breaking up their operation into 20 or so root certs.
- sterlind 8y agoAs much as I'm tempted to agree, decentralization perhaps risks even more. Opsec compromise is only one SPOF for a signing service; the state might coerce the CA into handing over the keys or issuing an intermediate for MitM. Do you shard across 20 nations? If so, you have to contend with 20 intelligence agencies. It might make more sense to keep all the eggs in one basket, and have new baskets ready to go if a canary triggers.