4 ms·

Wouldn't you want to validate it for the time at which it was served? In which case you'd just an archive of the CA roots at the time.

• paxys 5y ago
  And how do you verify that the CA roots are authentic?
  • notriddle 5y ago
    The Hg history from Mozilla-Central?
    • paxys 5y ago
      Sure but that's still a third party dependency. And then you have to verify that the Firefox source is authentic. My point is there's no way to have a fully self verifying archive.