> I have a hard time believing that WebAuthn is some grand plot by Big Tech to lock people into their walled gardens. I do not agree. I think it (and some rela

> I have a hard time believing that WebAuthn is some grand plot by Big Tech to lock people into their walled gardens. I do not agree. I think it (and some related things) is a grand plot, and mostly seems to benefit Google and Cloudflare, for lock in. (They might also want to actually improve security in some ways, but that is minor, and there are better ways to do that anyways.) I think X.509 would be better (and does not require a web browser to use, nor does it hide stuff from the user, and also does not require a new different incompatible specification to be made for everything). (Unfortunately, the way X.509 is often used (for server authentication) is also in bad ways, but it can be used better, both for server side and client side.)