> Citation very much needed for this claim that (publicly trusted) Certificate Authorities are "regularly compromised" while some random guy's PGP keys on his l

> Citation very much needed for this claim that (publicly trusted) Certificate Authorities are "regularly compromised" while some random guy's PGP keys on his laptop are "much more secure". Actually X.509 keys evolved under enterprise pressure and some devices have nice additional security measures. For example it's possible to attest that a given X.509 key was generated on a Yubikey (so it's only in hardware, no copies exist) [0]. Microsoft EV code signing certs require hardware keys. OpenPGP doesn't have this. [0]: https://developers.yubico.com/yubico-piv-tool/Attestation.html https://developers.yubico.com/yubico-piv-tool/Attestation.ht...