> But that's why I think the role of the CA should change so that the signatures actually gives some form of tangible trust that people can relate to. But this

> But that's why I think the role of the CA should change so that the signatures actually gives some form of tangible trust that people can relate to. But this is a tough thing to do. The best way to do this would be to introduce a new type of certificate, that can be stapled onto web requests maybe (eg. a signature at the end of the http body), that isn't controlled or authenticated by any existing system. This would allow clients to implement this system based on merit and based on whether or not it solves problems and concerns these clients have. For example, if it's literally just EV certificate boogaloo[0], then Chrome can choose to not implement it. But when you try to force it onto people in the form of QWACs or what have you, and have it government-mandated, this goes against the theory of 'open source' standards being adopted because they're a good standard, and instead degrades user experience by forcing client vendors to implement them regardless of their flaws. 0: https://scotthelme.co.uk/the-power-to-revoke-lies-with-the-ca/ https://scotthelme.co.uk/the-power-to-revoke-lies-with-the-c...