Thanks for the clear summary. I'm still not particularly convinced by Mozilla and Apple's reasoning, though. Firstly, there are many use-cases where the conte

Thanks for the clear summary. I'm still not particularly convinced by Mozilla and Apple's reasoning, though. Firstly, there are many use-cases where the content signer does not care whether an attacker has managed to steal their private key. For example, sites that just host static content (like cat pictures). There are even some hosts who don't see the point in TLS at all, as they don't believe they are hosting anything that an attacker would want to interfere with. Secondly, this is an opt-in feature and not something that would apply to all TLS certificates, so entities who considered it a genuine risk could just not use the technology. (They might also have to keep an eye on certificate transparency logs to make sure that an attacker hasn't requested such a certificate for their domain by controlling their DNS, but hosts should be doing these checks anyway, and if an attacker is in control of your DNS and has received a TLS certificate for your domain then you have bigger problems than Signed Exchanges. In any case, such certificates can be revoked once the legitimate owner has control over their domain again). Thirdly, hosts which do opt in to using Signed Exchanges can choose to include code in their signed content which sends a background HTTP request to their servers, as a way to "phone home". That wouldn't be able to detect when a key had been stolen, and it probably wouldn't reveal where the content had actually been served from (unless the specification were altered to allow signers to require that) but it would at least give signers visibility of which content was still being served. Finally, the biggest risk to websites is not that "the host serving the web package has access to plain text", because these are publicly served files which everyone has access to. The biggest risk is phishing, where a victim believes they are visiting a certain site but they're actually visiting a site with a similar-looking name, which TLS doesn't prevent and Signed Exchanges doesn't make any easier.