4 ms·
It shifts the trust to a single CA instead of all the CAs.
by ocdtrekkie 6y ago
It shifts the trust to a single CA instead of all the CAs.
- a1369209993 6y agoMore precicely, it means that compromising the public key infrastructure requires compromising one specific CA, rather than compromising any single CA out of hundreds. Ideally, we would it to instead require compromising all CAs out of hundreds, but as long as the defective-by-design X.509 PKI is used, that's not very possible, much less likely.