> What Letsencrypt does Letsencrypt is run by Mozilla. So lets instead make that: > What Mozilla does ... is that you control the domain you are requesting a

> What Letsencrypt does Letsencrypt is run by Mozilla. So lets instead make that: > What Mozilla does ... is that you control the domain you are requesting a certificate for. So Mozilla trusts me based on me controlling the DNS of my domain, and can issue me a security-token which Mozilla's browser (and other browsers) then can trust. Note: It does not trust me or verify me to be non-malicious, honest or have good intentions of any kind. It merely verifies that I control the DNS of the domain I request a certificate for. That's it. That is all. So why can't Mozilla's browser simply instead of trusting these magic tokens, instead just verify that the cert for the site matches the cert pinned in DNS, thus validating that the site-operator is indeed in control of the DNS of his domain? It will be exactly the same validation, except now we don't have to rely on a third-party service to do that for us. And then the web can finally be autonomous and decentralized again.