so the trust is in Debian or whoever's running your repos instead of MSFT. I don't see how that really changes the dynamic a lot. The problem with most people'

so the trust is in Debian or whoever's running your repos instead of MSFT. I don't see how that really changes the dynamic a lot. The problem with most people's complaints and solutions about certificate authorities is that pretty much every proposed solution, when applied at scale, becomes functionally equivalent to the web of trust system we currently have. At one point you have to trust _somebody_.