Yeah. From the RFC draft: > If a new landmark is allocated every hour, signatureless certificate subtrees will span around 4,400,000 certificates, leading to 2

Yeah. From the RFC draft: > If a new landmark is allocated every hour, signatureless certificate subtrees will span around 4,400,000 certificates, leading to 23 hashes in the inclusion proof, giving an inclusion proof size of 736 bytes, with no signatures. https://davidben.github.io/merkle-tree-certs/draft-davidben-tls-merkle-tree-certs.html#name-size-estimates https://davidben.github.io/merkle-tree-certs/draft-davidben-... That's assuming 4.4 million certs per landmark, a bit bigger than your estimate. There's also a "full certificate" which includes signatures, for clients who don't have up-to-date landmarks. Those are big still, but if it's just for the occasional "curl" command, that's not the end of the world for many clients.