| ▲ | tuwtuwtuwtuw 2 hours ago | |
He was asking, not putting forward an argument. Trusting a CA that uses 4 as the private key is risky. If it's a small CA that issued certs that you don't need to consume, it would be an unnecessary risk to trust it. | ||
| ▲ | devrand 2 hours ago | parent [-] | |
This has come up in discussions before. The argument that small CAs shouldn't be in root stores since they have huge risk for little upside is compelling, except that it would also make it impossible for businesses to enter the market. You'd need to prove you have market share, but you cannot reasonably get market share if you're not in a root store. So you'd just end up with the big players (ex. Sectigo, who cross-signed these certs btw), who would then claim too big to fail should anything actually go wrong with them (see: Comodo). | ||