Note that this is not the CA/Browser Forum, the usual industry association you hear about. The CA Security Council is a group of a small number of old-guard CAs, which has been notable recently for pushing a distinction between (automatic) domain validation, organizational validation, and Extended Validation, mostly as a response to Let's Encrypt. The "London Protocol" appears to be a proposal for formalizing the distinction between DV and OV + EV: https://casecurity.org/2018/06/27/the-london-protocol/
If you look at this previous paper they (Entrust + Comodo) published, they're proposing that OV and EV certificates get padlocks and DV ones don't: https://casecurity.org/wp-content/uploads/2017/09/Incidence-... Or, in other words, you can't get a padlock from Let's Encrypt and you'll have to pay them for a padlock.
Compare with Google's plan at
https://blog.chromium.org/2018/05/evolving-chromes-security-... which just drops the padlock for everyone, treats plaintext HTTP as affirmatively insecure, and stops pretending that paying money to a CA means that you're a morally upright website.
A CA leaving the CASC seems like a good thing for the world.
If you look at this previous paper they (Entrust + Comodo) published, they're proposing that OV and EV certificates get padlocks and DV ones don't: https://casecurity.org/wp-content/uploads/2017/09/Incidence-... Or, in other words, you can't get a padlock from Let's Encrypt and you'll have to pay them for a padlock.
Compare with Google's plan at https://blog.chromium.org/2018/05/evolving-chromes-security-... which just drops the padlock for everyone, treats plaintext HTTP as affirmatively insecure, and stops pretending that paying money to a CA means that you're a morally upright website.
A CA leaving the CASC seems like a good thing for the world.