I like TACK as a technical solution to this problem, but there is also the possibility of improved regulatory oversight. My question is why there isn't a strong

I like TACK as a technical solution to this problem, but there is also the possibility of improved regulatory oversight. My question is why there isn't a stronger, official governing body for inclusion of certs in browsers. Right now it looks like MS, Mozilla and Google are the de facto deciders of whose certificates can be bundled by default in a browser. This basically decides who can be a root CA. The problem is, as three un-coordinated entities with no formal relationship, they have no procedure for putting the toothpaste back in the tube - they can't revoke a certificate, because there's no procedure. Personally, I would promote the creation of a separate body for managing root CA certificates, in which any browser vendor could participate. Members would agree to bundle only the certs approved by the body. The body would collect from participating CAs a certain portion of the monies paid for certificates - somewhere between 25% and 50%, to be released when the certificate expires. This serves as a sort of escrow for services rendered - customers can be confident they will get n years of use out of a certificate, even if the CA vanishes. Top level CAs would be responsible for remitting payments from intermediates they authorized. This would form a fund to facilitate the movement of customers, in the event a CA became illiquid or was deauthorized - sort of an FDIC for SSL certs. If a breach of trust occurred, or a CA went bankrupt, had its assets seized by a corrupt government, etc. this body would have the authority to blacklist the CAs certs after a window - 30 to 60 days. They would notify all of the CA's customers that they were being issued new, free certificates from a still-authorized CA of their choosing, with the payment for the new CA to be issued ( at a lower than market, but not insubstantial ) from the depository insurance fund. The body would provide customers with a list of approved CAs by country, and while the remitting process would likely be a nightmare the first time, at least people would have a timely way to get new, valid certs. Customers would complain a bit about the work to deploy new certs, but that's the cost of running (actually) secure infrastructure. This would achieve a few goals: - browsers would be obligated to bundle a common set of certs, with a common approval and audit process. This should be less work for new CAs to get approved - CAs would have a financial incentive to stay secure - a breach means we can legitimately revoke your authority, and you no longer own the cash we held in escrow - browsers would have teeth to create a 'death penalty' like Mozilla proposes, and better yet, they would all have the same criteria - certificate owners would be less conflicted between user security and their financial interests - the escrow would reduce their losses if a CA became insolvent