> Things like Let’s Encrypt Any CA will do that. Paying a hundred bucks for a certificate will has never stopped a malicious actor, therefore Let's Encrypt doe

> Things like Let’s Encrypt Any CA will do that. Paying a hundred bucks for a certificate will has never stopped a malicious actor, therefore Let's Encrypt does not introduce any new concern. > Cert pinning sort of protects against this DANE was designed for this. Since DNS is always a SPOF on the web, registering TLS public keys in DNS reduces the attack surface (instead of introducing a new channel for transport security). > The certificate transparency efforts also sort of protect against this That's bullshit. Nothing prevents a CA to emit certificates without declaring them. We should not rely on those big corporations for our security: our interests are FAR from aligned.