alt Hacker NewsThere is no valid reason my computer should come preloaded with 100+ trusted certificates from many jurisdictions that all can sign certs for all domains.
Only a few major CAs in jurisdictions that admit heavy scrutiny and legal liability should operate. Country-specific CAs, if any, should only be scoped to signing certificates for their respective ccTLDs.
Replies
bobthebuilder4 • yesterday at 7:00 PM
I was thinking exactly the same and thought I must not understand how it works, no idea why I should trust any CA's on the other side of the world.
Country specific CA that can only sign ccTLD actually make sense to me