I have high hopes for TACK too. The fact that it's not CA dependent is a big deal. I wrote a bit about that, and getting by with ditching the root CAs in Firefo

I have high hopes for TACK too. The fact that it's not CA dependent is a big deal. I wrote a bit about that, and getting by with ditching the root CAs in Firefox here: https://rx4g.com/2013/09/13/of-flying-pigs-and-tofu/ https://rx4g.com/2013/09/13/of-flying-pigs-and-tofu/ Unfortunately, ditching the root CAs is way harder than it should be, and flat out impossible in a lot of environments. Compulsory trust isn't trust.