There is no valid reason my computer should come preloaded with 100+ trusted certificates from many jurisdictions that all can sign certs for all domains.

Only a few major CAs in jurisdictions that admit heavy scrutiny and legal liability should operate. Country-specific CAs, if any, should only be scoped to signing certificates for their respective ccTLDs.

▲

tepmoc 4 hours ago | parent | next [-]

Country specific CA that can only sign ccTLD actually make sense to me

▲

morningsam 4 hours ago | parent [-]

I came here looking for a comment suggesting just that. But surely there is some massive issue with this idea we are overlooking? Otherwise I don't see why it hasn't already been implemented long ago, it seems so obvious as a mitigation.

▲

tgma 4 hours ago | parent [-]

Legacy CA/Browser Forum politics.

Also the industry has changed a lot since Let's Encrypt. You could have argued against monopolizing the CA issuance to just a few countries/entities as sovereignty issue, and CAs were indeed exhibiting extreme rent-seeking behavior before Let's Encrypt. With a guaranteed free and accessible alternative in the mix, the weight of the arguments against would change.

	▲	VorpalWay 2 hours ago \| parent [-]
		Honestly, why would we need anything except LE for TLS certs? Sure, they don't issue EV certs, but isn't that completely dead by now anyway? You could argue single point of failure, which is fair, so then set up another LE clone which is run in a similar way in another (reasonable) country. (And there is of course non TLS certs, such as code signing and S/MIME, if that is still a thing. I'm only arguing about the TLS case here.)

▲

bobthebuilder4 2 hours ago | parent | prev [-]

I was thinking exactly the same and thought I must not understand how it works, no idea why I should trust any CA's on the other side of the world.