> In this context, the question is more "how is a registrar holding your keys in any aspect worse?" I find it fairly obvious that such an extra operator in the

> In this context, the question is more "how is a registrar holding your keys in any aspect worse?" I find it fairly obvious that such an extra operator in the middle of the trust chain between your webserver and your end-user is worse. > but your registrar generally has de facto control over your domain under the no-DNSSEC PKI anyway. Yes-ish. The issue is that DANE+DNSSEC would give the registrars control over the keys, which door they belong to and nobody could determine otherwise. A registrar trying to do the same right now with WebPKI would most likely be pathetically caught in the act, either by trying to redirect traffic without a valid certificate or trying to issue a certificate and it getting logged.