You do not need a single key-issuing service for IBE: http://www.argreenhouse.com/society/wcan06/wcan06s4p3.pdf http://www.argreenhouse.com/society/wcan06/wcan

You do not need a single key-issuing service for IBE: http://www.argreenhouse.com/society/wcan06/wcan06s4p3.pdf http://www.argreenhouse.com/society/wcan06/wcan06s4p3.pdf Of course, you would need to be judicious about which group of key issuers you are willing to trust, but this method will at least reduce the risk. The other nice thing about this is that even if some key issuing service is compromised, the sender can force the receiver to switch services (compare to the TLS model, where dropping a CA is basically a coordination game problem).