We've already apparently decided that it is OK to rest our security on the idea that careful organizations can keep secret keys secret. I'm not sure that's tr

We've already apparently decided that it is OK to rest our security on the idea that careful organizations can keep secret keys secret. I'm not sure that's true. We might tolerate that situation in specific circumstances where we haven't identified any better choice, but that isn't the same as thinking everything is OK. For example, in the case of certificates used for things like downloading web content over HTTPS, the centralised nature of the CAs and the track record where not all CAs have proved to be trustworthy is a significant concern in the industry. This remains the case even though browsers can revoke the root for any CA that is compromised and despite the increasing use of mitigations like perfect forward secrecy. The rise of Let's Encrypt in particular has been a boon for moving smaller sites to serving over HTTPS by default, but given how many sites now rely on it, it also creates a huge single point of failure in the security infrastructure of the web. Notwithstanding the precautions taken by the operators to keep the most important secrets secret, if anyone hostile did ever manage to compromise that infrastructure covertly, that would be catastrophic for security on the web.