None taken, I understand the difference quite well. Any identity system should ideally be designed so the disclosure of identifying information is limited to p

None taken, I understand the difference quite well. Any identity system should ideally be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship. Neither BrowserID nor WAAD are justifiable parties. My question relates to BrowserID regardless of the value to local.ch. So, similarly, no offence, but saying "PKI" and "protocol" does not provide assurance. Does the BrowserID PKI implementation provide non-repudiation? Is it used to detect spoofing, tampering, to make a big secret a little secret? Does it in fact implement the protocol as specified? I'm not saying it doesn't. I'm suggesting that until it's proven itself, BrowserID doesn't get my trust.