I recognize that they had a lot of issues and I'm glad the implementation of EV certs that we had died out, but I've always thought the concept itself wasn't a bad one. For stuff like banking or government websites, it would be nice to have them tied to a legal entity instead of purely just a domain name.
In theory we could even limit it so that only a given country's CAs can sign entities under that country (somewhat mitigating the whole eMudhra thing...)
It does feel like kind of a shame sometimes, there's a lot of stuff that would be possible with TLS/certs/webpki that we don't really explore. Mutual TLS, for instance. I get why, and I'm as happy as anyone that Let's Encrypt exists, but sometimes it feels unfortunate that we've settled into the comfort zone of "get a domain name, pull an LE cert for it" and don't often do much else with the technology and all the CA infrastructure.
In theory we could even limit it so that only a given country's CAs can sign entities under that country (somewhat mitigating the whole eMudhra thing...)
It does feel like kind of a shame sometimes, there's a lot of stuff that would be possible with TLS/certs/webpki that we don't really explore. Mutual TLS, for instance. I get why, and I'm as happy as anyone that Let's Encrypt exists, but sometimes it feels unfortunate that we've settled into the comfort zone of "get a domain name, pull an LE cert for it" and don't often do much else with the technology and all the CA infrastructure.