SSL/TLS is something that needs to be thrown away and start over (not that it would happen realistically without immense pressure after another spectacular fail

SSL/TLS is something that needs to be thrown away and start over (not that it would happen realistically without immense pressure after another spectacular failure). The over-complexity of X509 and the ease of which one can acquire legitimate certs for domains one doesn't own is appalling. From recent revelations, it's even more troublesome the number and scale of exfiltration of private keys, making it possible for some state actors to MITM 10's-100's megaconnections. (One has to put on their tinfoil hat to estimate how many countries have successfully placed staff in core IT/webops positions of Fortune 100 that are then able to leverage that access... Not to mention high-level engagement. [The direct approach conversation might go like this: "gives your keys or we will send in agents to expose embarrassing details about your org and we will still get the keys anyway."]) Perhaps folks like 'cperciva would be kind enough to propose a single, simple TOML-based cert system that is extremely lightweight with the fewest of features. (Not that TLS/SSL would change without focused, sustained herculean effort immediately after yet another Heartbleed.)