There needs to be a mechanism where a site can provide its verified identity to allow the user to know exactly who they are.
Not every site will need or want this but the ability should exist.
At the moment EV provides this ability. If EV is not seen as the answer then we need to have something else instead. We could decouple this from HTTPS but identity is also a valid purpose of signed certificates.
Not every site will need or want this but the ability should exist.
At the moment EV provides this ability. If EV is not seen as the answer then we need to have something else instead. We could decouple this from HTTPS but identity is also a valid purpose of signed certificates.