This the closest we have so far to an answer to the point raised in the IETF 105 Technical Plenary a few days ago.
Encrypting everything means that IoT devices represent an unknown threat - your "smart" TV connects to Sourceforge and downloads... something every week. What for? Your "smart" thermostat calls the IP of the vendor, maybe to get firmware updates, but it also calls the Disney corporation - what for? You can't snoop any of this because it's using encryption with pinned keys, so MITM doesn't work. Obviously hardcore reverse engineering is possible, but it's extremely expensive. So in practice it won't get done.
But, if we can popularize a safe option, we can just flag all the unsafe approaches that are popular today. We can teach vendors that this is a bad idea and they shouldn't do it, and (cross fingers) it might go away, like X-ray shoe sizing.
Encrypting everything means that IoT devices represent an unknown threat - your "smart" TV connects to Sourceforge and downloads... something every week. What for? Your "smart" thermostat calls the IP of the vendor, maybe to get firmware updates, but it also calls the Disney corporation - what for? You can't snoop any of this because it's using encryption with pinned keys, so MITM doesn't work. Obviously hardcore reverse engineering is possible, but it's extremely expensive. So in practice it won't get done.
But, if we can popularize a safe option, we can just flag all the unsafe approaches that are popular today. We can teach vendors that this is a bad idea and they shouldn't do it, and (cross fingers) it might go away, like X-ray shoe sizing.