4 ms·

> A PKI where the CA private key is not secret is not really a PKI now is it? At the end of the day, _you_ are the one in control of the list of CAs that you

> A PKI where the CA private key is not secret is not really a PKI now is it? At the end of the day, _you_ are the one in control of the list of CAs that you trust. If you are, it is (maybe) security. If you aren't, it is DRM. This is a simple rule with surprisingly little grey areas. See eIDAS... > I doubt 0.001% of buyers in any market segments has a clue about PKI Does it really matter how is the DRM implemented? They don't want to hear about Apple DRMing iPhone repairs, end of story. PKI is also not the only way to implement this.

oneplane 3y ago
You are confusing browser TLS and the trusted CA list with general CA in terms of PKI. So no, you are not in control and there is no list. > Does it really matter how is the DRM implemented? If you want to argue semantics instead of facts and merit: yes. > PKI is also not the only way to implement this. Yes it is. Unless you have some novel method you are about to disclose to the world, in which case, please do, because you'd have the equivalent of a cryptographic holy grail.