Author here. BankAPI is actually using HTTPS, but doesn't depend on SSL alone, as the files/messages are also encrypted/signed using OpenPGP. This means banks

Author here. BankAPI is actually using HTTPS, but doesn't depend on SSL alone, as the files/messages are also encrypted/signed using OpenPGP. This means banks would not have to trust all the CAs who issue SSL-certificates, as the OpenPGP public keys are imported once for each bank you wish to communicate with, and won't change unless you explicitly update them. The value it adds is the two layers of security (HTTPS+OpenPGP) and the "DeliveryReceipt" which makes it possible for both parties (the sending and the receiving bank) to prove they did send and did receive all files/messages sent over BankAPI.