> people generally do manage their own TLS keys. What? No, most people do not run their own web server. Most people have their web site on a web host, and le

> people generally do manage their own TLS keys. What? No, most people do not run their own web server. Most people have their web site on a web host, and lets the web hoster manage it, including the TLS keys. Just like with DNS and the DNSSEC keys. > Who, other than DNSSEC providers themselves, would need to be paged if the DNSSEC root keys ended up on Pastebin? I freely admit that I don’t know. Beside ICANN, I’m guessing all the TLD operators, since their records can now be spoofed with impunity. But, I guess you could also ask: What would happen if, say, the keys for the X.509 certificates for google.com was leaked?