4 ms·
Why shouldn't we be (optionally) cutting CAs out of this? They're already known to be a weak link in the chain. How about they make it an option to put your ow
by Scramblejams 13y ago
Why shouldn't we be (optionally) cutting CAs out of this? They're already known to be a weak link in the chain.
How about they make it an option to put your own certificate chain in your DNS records, require DNSSEC and use pinning to cover the fact that the DNS server might get intermittently MITM'd?