As always, trustworthy encryption boils down to identity assurance. Even in real-world personal interactions, identity assurance is subject to a leap of faith (

As always, trustworthy encryption boils down to identity assurance. Even in real-world personal interactions, identity assurance is subject to a leap of faith ("I believe this person is who they say they are based on the evidence they presented"). As such, is this problem even solvable? People rely on a much less stringent level of assurance to create secure connections on the Internet, because they want it handled within a single mouse click, and that expectation isn't going to change. At least with a certificate issued by the registrar, there's some logical reason to believe that it was issued to whoever purchased the domain (whoever that is), which is often enough to establish an encrypted connection at a level the user expects. Significant problems remain, however: 1) Most domain owners have no idea how to generate a key and CSR (the registrar shouldn't do it) and 2) a truly reliable system for certificate revocation must exist to handle domain transfers. These aren't new problems, they just don't go away by shifting to this "easier" approach.