People have made a reasonable rebuttal to the article here... But there's a double edge to the HTTPS sword that I don't think is being discussed. Automating thi

People have made a reasonable rebuttal to the article here... But there's a double edge to the HTTPS sword that I don't think is being discussed. Automating things with cron is the weak and easy argument to defeat. There's a much harder one he's hinting at though. The year is 2040. HTTPS is by and large well adopted, and certificate authorities have waned under the power of let's encrypt. Firefox and Chrome have progressed from showing a warning, to refusing to load sites that are insecure, much like how expired certificates are handled today. However, the government has adopted control over much of the internet. Facebook is now run by the federal government, and most online interaction requires a government photo ID. Further more, comments you made in the past have damaged your social credit score, and Let's Encrypt will no longer issue you certificates, and traffic to your static blog has dramatically dropped to near zero. Not to mention, the hit your site takes in page rank for not offering https any more. There's a million things that can be said about how to operate in such a world -- and by and large it seems we're headed that way. But this fact remains: certificate authorities are a centralized power that the public can't control. And that means you're at their mercy.