Thought-provoking. I didn't consider why LE is free (sponsored by Google and AWS) and that it can technically change that at any time. I'm still going to contin

Thought-provoking. I didn't consider why LE is free (sponsored by Google and AWS) and that it can technically change that at any time. I'm still going to continue using HTTPS for now since it's my status quo, but I guess, for public websites, the choice to use HTTPS or not depends on whether or not one agrees that widespread HTTPS is vital to discourage ISP/government snooping. I disagree with the TOFU recommendation, though. From my knowledge, it kinda works for SSH since you're mainly connecting to servers you control; not so much for the WWW. Anyone remember MonkeySphere? I also disagree with the 3-month criticism. I think LE has a good justification for it: usually, renewal is either automated or forgotten about, so a short timespan forces automation. The bomb analogy doesn't really make sense as certificate expiry serves a practical purpose unlike a bridge-bomb.