> It's too bad it's based on DNSSEC. Yup, that about covers it. My favorite DNSSEC feature is TLDs and .govs continually fucking it up. More seriously this vs

> It's too bad it's based on DNSSEC. Yup, that about covers it. My favorite DNSSEC feature is TLDs and .govs continually fucking it up. More seriously this vs CAs is just a philosophy argument. CAs are a club of grandfathered "trusted" parties. This is single source .govs and other TLDs for the trusted party. Yay. Currently I, personally, can choose to not trust Verisign and go with another CA. In this world I can trust Verisign, because they own .com, or go fuck myself. Clearly a win. Oh well soon enough some jackass will put this in a FISMA or PCI DSS requirement and everyone will support it anyways.