alt Hacker News"It seems like you're visiting a site registered in XYZ country. Do you want to start trusting XYZ country key authorities?
[Do Not Trust], [Trust Once], [Trust Forever]"
"It seems like you're visiting a site registered in XYZ country. Do you want to start trusting XYZ country key authorities?
[Do Not Trust], [Trust Once], [Trust Forever]"
Then users just proceeds to hit trust for everything, just like people blindly accept ssh keys.
The country comparison doesn't do much either, because there isn't a good guarantee that they'll correspond. Some guy posted a repo to distrust every CA except the top 30, and that has a bunch of weird examples, like a bunch of russian sites being signed by a Greek CA. Not to mention some of the biggest sites use CAs that don't correspond with their country of origin. GlobalSign is Belgian for instance. Guess how many of their customers aren't Belgian?