People say stuff like this all the time, as if "the blast radius" of fucking up .COM or .CO.UK or .IO was somehow small.
Constrained names aren't a solution for this problem. eMudhra had a thriving business selling certificates to US organizations. Unless you're really coming from a place of "we can't trust companies in India", the only coherent thing you can be arguing is that only one company should issue certificates from North America.
We tried that before. It was called Verisign. In a DANE-first world, it would again be Verisign. Immutably, and without accountability. There would be no transparency logs and no dis-trusting of them when they inevitably misissued at the behest of the United States Government.
The WebPKI's answer to this problem is to gradually ratchet requirements so that fewer and fewer companies can run CAs, and to build and coercively require transparency mechanisms like CT (something people on this thread inexplicably object to as "bullying") so those requirements can be enforced.
Constrained names aren't a solution for this problem. eMudhra had a thriving business selling certificates to US organizations. Unless you're really coming from a place of "we can't trust companies in India", the only coherent thing you can be arguing is that only one company should issue certificates from North America.
We tried that before. It was called Verisign. In a DANE-first world, it would again be Verisign. Immutably, and without accountability. There would be no transparency logs and no dis-trusting of them when they inevitably misissued at the behest of the United States Government.
The WebPKI's answer to this problem is to gradually ratchet requirements so that fewer and fewer companies can run CAs, and to build and coercively require transparency mechanisms like CT (something people on this thread inexplicably object to as "bullying") so those requirements can be enforced.