Re:TLS Everywhere, not https: URIs (2015)
by dredmorbius on Monday August 08, 2016 @12:27AM
(#12245492)
Thanks. So re keysharing, authentication is a form of secure channel.
I'm reading the auth and channel as independent. Auth is something of a metachannel, perhaps.
Relevant to my original post, information about whether the connection should be encrypted also merely needs to be authenticated, not encrypted itself. Of course, the HSTS preloading site uses HTTPS (with encryption) because it's easy and why not.