they can fetch the key or its hash from DNS. it's not like the current system is that much more involved. current system is basically a third party signed cache of such ownership claims validated based on ability of someone to modify DNS records.

All caches are just functionally useless layers..., so that's that.

▲

coldpie 2 days ago | parent | next [-]

How do I know that the DNS record is owned by the entity they are claiming to be? CAs have nothing to do with caching.

▲

megous 2 days ago | parent [-]

You don't know that even with DNS validated certificates. There's no separate "entity" claim other than "anybody with DNS record modification rights for a given domain".

You can give out the same claim over DNS directly without any extra third party involvement in the form of CA.

	▲	coldpie 2 days ago \| parent [-]
		Huh, wow. I kind of thought the whole point of CAs was to do identity verification. It they have dropped that entirely, what is the point?

▲

mirashii 2 days ago | parent | prev [-]

DNS can be trivially MITM'd as well, it's certainly not a secure mechanism for distributing keys.

	▲	megous 2 days ago \| parent [-]
		You just taken down the whole business of dns validated CA issued certificates. Go claim your bounty. :)