The author recommends TOFU as an alternative. TOFU is great until it isn't. Web servers do get hacked all the time (mostly thanks to Wordpress), and when they d

The author recommends TOFU as an alternative. TOFU is great until it isn't. Web servers do get hacked all the time (mostly thanks to Wordpress), and when they do, rotating any and all private keys is high on your action list (preferably through nuking the machine from the orbit). The short expiration date on the certificate is specifically meant to address this problem. CRLs don't work, not even by principle - how often are you meant to refresh them? Who's volunteering to handle the load? Which circles us back to the underpinning of the fundamental problem: DNS is insecure. If DNSSEC was to be the answer, where is it, 20 years in? Can we pretty please adopt DNSCurve instead already?