I think I've stumbled upon that EFF link at some point, but I didn't study it very much. The CA graph they list there is nice, but it doesn't say much since ma

I think I've stumbled upon that EFF link at some point, but I didn't study it very much. The CA graph they list there is nice, but it doesn't say much since many of the CAs there don't actually sell to consumers certificates, no? Looking at this PDF[1] I see on page 23 that there are about 30 root CAs that have signed more that 1000 certificates. And (from page 21) it seems to me that the providers are very much US centric. With regard to what does the SSL cert contain, I don't know much about this field, but I do know that the certificate may present and organization name and address/state/country. Hence I assume, identity also matters for some besides just domain ownership. Anyhow, I'm not claiming I've found a better solution than the smart guys sitting down and working out solutions, but I do find annoying that the solution they found is so expensive for commoners. As an armchair discussion, I still think that certificate info seems best to belong into a DNS record. DNSSEC perhaps could help with this? 1. https://www.eff.org/files/DefconSSLiverse.pdf https://www.eff.org/files/DefconSSLiverse.pdf