First, thanks for all the work on the right direction. I have some questions. Why won't we fall on the same problems we had with SSL certificate issuers until

First, thanks for all the work on the right direction. I have some questions. Why won't we fall on the same problems we had with SSL certificate issuers until Let's Encrypt truly made HTTPS viable to everyone? What will prevent requestors from requesting all or most users attributes like most apps do with permissions on Android platform? Edit: add "with permissions"