More on trusted introduction: countersigning and resilience about avoiding-internet-centralization HOT 2 CLOSED

I'm a bit reluctant to second-guess protocol design discussions, especially regarding security properties. Having a second signature on a cert can be seen to add risks of compromise and might add more failure modes -- how that security be balanced against centralisation issues is a discussion that needs to take place in the WG informed by drafts like this, not pre-determined by them.

Underlying that is something we might be able to tease out more questions, though -- e.g.,

• Is having a choice between multiple operators / suppliers (such as CAs) an effective technique against centralization?
• Does it depend on other factors (e.g., switching costs)?
• What's the relationship between centralization and short-term dependencies (e.g., your site going down and not having a backup cert take over, but coming back up relatively soon thereafter) vs. long-term lock-in (e.g., you being beholden to an operator/issuer for an extended period of time)?

from avoiding-internet-centralization.

I've started to talk about friction and switching costs in "what is centralization?" Undoubtedly there could be more, but I want to let this stew for a little while first...

from avoiding-internet-centralization.