> you don't have all the available keys, because servers can selectively change their responses Well, that's the entire point of the log, isn't it? To make sur

> you don't have all the available keys, because servers can selectively change their responses Well, that's the entire point of the log, isn't it? To make sure that everybody is seeing the same keys. If the keys you got from the upstream link in the DNS chain doesn't match the one in the log, you reject them, because you are being spoofed. > to design a transparency scheme for the DNS PKI, one that does not currently exist, which is deliberately different than Certificate Transparency > now that you've learned that Certificate Transparency won't work for DNSSEC It wouldn't work exactly like it is, obviously, which is why I've been saying "CT-like" system, not the exact same CT incantation that exists right now which was explicitly designed for WebPKI, not a DNS PKI. Your argument is like saying in the year 2002: "electric vehicles can't possibly work because gas stations are not designed for electric vehicles". Well, not exactly a sound argument you have there, now is it? :) > You've vindicated my argument. I highly doubt that :)