Country specific CA that can only sign ccTLD actually make sense to me

I came here looking for a comment suggesting just that. But surely there is some massive issue with this idea we are overlooking? Otherwise I don't see why it hasn't already been implemented long ago, it seems so obvious as a mitigation.

▲

tgma 4 hours ago | parent [-]

Legacy CA/Browser Forum politics.

Also the industry has changed a lot since Let's Encrypt. You could have argued against monopolizing the CA issuance to just a few countries/entities as sovereignty issue, and CAs were indeed exhibiting extreme rent-seeking behavior before Let's Encrypt. With a guaranteed free and accessible alternative in the mix, the weight of the arguments against would change.

	▲	VorpalWay 2 hours ago \| parent [-]
		Honestly, why would we need anything except LE for TLS certs? Sure, they don't issue EV certs, but isn't that completely dead by now anyway? You could argue single point of failure, which is fair, so then set up another LE clone which is run in a similar way in another (reasonable) country. (And there is of course non TLS certs, such as code signing and S/MIME, if that is still a thing. I'm only arguing about the TLS case here.)