I think it would be cool to have a standard URL (/.well-known/certificate or something) that explains why you should trust their self-signed certificate, and have the browser show that as part of the view when you encounter a self-signed cert.
The current PKI system allows you to make an unsolicited encrypted connections to an internet origin over an untrusted connection with strong server authentication.
Self signed can not provide this. We do not want the web to be like SSH.
Also, PGP is a very different security model - in order to effectively use PGP, you need to go disclose your government identity to a handful of other people who are already in the strong set. That's not a great fit for the web.
Now, if you have a CA who gives out certificates to parties who should not have them, and that CA can sign certificates for any domain, how do you know if any connection is a MiTM or benign? Do you actually check the issuer every time you connect to a secure site?
CAs give a false sense of security. We need to move off this model.
How?
CAs give a false sense of security. We need to move off this model.
Maybe, but not by adopting the politician's syllogism. We should only move to a better model. As easy as it may be, it's still slightly harder to get a CA to sign a cert for a domain you don't control than it is to sign them yourself, and that shouldn't be dismissed.
If I go to a bank or business, and as part of setting up a relationship they hand me a pamphlet printed with their Public Key Fingerprint, AND the browser shows me that fingerprint image at first use, ..... then that's pretty reliable verification, isn't it?
Obviously we've never had face-to-face relationships with the likes of Paypal, Stripe, etc, and would still rely on our browser and operating system vendors to validate the chain of authority.
There's IIRC no mechanism for that, but for the single-domain CA key it'd make sense to sign the new one with the old one.
There will be some jurisdictions where MiTM is always and unavoidable. TOFU can't work here.
These things must be universal, and TOFU can never be universal.