> I think the idea that CAs are uniquely incompetent is probably incorrect.
The problem with the certificate authority system is that any CA can sign a cert for any domain name. It only takes 1 incompetent or malicious CA to break the whole system wide open. And there are so many CAs that inevitably some of them are incompetent, and use keys like 7. And some are definitely in bed with a government you don't like.
Moving certs into DNS means we only have to trust the registrars. Not the registrars AND the huge set of CAs.
The problem with the certificate authority system is that any CA can sign a cert for any domain name. It only takes 1 incompetent or malicious CA to break the whole system wide open. And there are so many CAs that inevitably some of them are incompetent, and use keys like 7. And some are definitely in bed with a government you don't like.
Moving certs into DNS means we only have to trust the registrars. Not the registrars AND the huge set of CAs.