>What we really need is less SSL and more page signing. This may more realistically address MITM tampering attacks, but doesn't address the second concern the

>What we really need is less SSL and more page signing. This may more realistically address MITM tampering attacks, but doesn't address the second concern the EFF and others are trying to mitigate, namely passive MITM eavesdropping[1]. CDNs are definitely a prime interception point if HTTPS can't be scaled more securely. To address the (hopefully short-term) scaling issues, I wonder if users will be asked to pick between a fully encrypted but slightly slower experience (anti-tamper + anti-eavesdrop), or a 'mostly secure' (anti-tamper only) and faster experience. [1] https://www.eff.org/https-everywhere/faq https://www.eff.org/https-everywhere/faq