> We also need a safe way for users of devices not on our list to send their key to us and demonstrate that it should be trusted This point is sort of hidden a

> We also need a safe way for users of devices not on our list to send their key to us and demonstrate that it should be trusted This point is sort of hidden away at the bottom of the article, although nearer the top they do boldly assert: > Trustworthiness is determined by the FIDO MetaData Service. It might seem like the proposed scheme is no different from the standard Web PKI system of certificates and certificate authorities (with FIDO taking the place of the CA/Browser Forum), but there's a fundamental difference: The browser, as a user agent, can be configured to trust a self-generated CA cert so you can access any site you want, but we are moving to a world where big companies get to place requirements on the sorts of devices you own - devices which by their nature have to keep secrets from you. This brave new world may prove to be genuinely better for security and even privacy, but I still think there are important unanswered questions, and not just the ones that the article glosses over with a "we also need". For example, is FIDO really going to brick 100,000 devices because someone managed to extract a key from one of them with an electron microscope? If each device costs $10, then that's $1,000,000 of damage, which is a tempting target to nation states or just bored college students.