It's not perfect by any stretch but I do like the idea. One problem we have in environments with strong security requirements is that peripherals, typically USB sticks, need to be authorized and controlled. Since there's typically very little information to actually uniquely identify devices, far too many USB devices have the same serial number, we end up having to just ban them altogether.

I welcome the world where machines trust my CA and someone who wants a USB device just comes to me, signs the paperwork, and leaves with a signed device that suddenly just works.

I mean pushing the security boundary to "someone with the knowledge to flash USB firmware without corrupting the certificate" is pretty darn good.

> I welcome the world where machines trust my CA and someone who wants a USB device just comes to me, signs the paperwork, and leaves with a signed device that suddenly just works.

Digicert surely welcomes this world! I personally don’t expect Digicert to have any real controls at all.

Also, right now, to put malware on a USB stick, you can just write malware to it. To create a USB stick that has malicious firmware to attack the host drivers, you need a USB stick that doesn’t protect its firmware or you need to build your own. In the new world, this changes to, drumroll please, a USB stick that neither protects its firmware nor wipes its key when new firmware is uploaded. Or you can build your own and pay Digicert, or you can attack a machine that doesn’t bother validating the signature because it wants to retain compatibility with the billions of existing unauthenticated USB sticks.

Also, if devices need per-device keys, then I suspect that firmware upload won’t wipe the key, since otherwise firmware upload mostly breaks the security model unless some rather complicated checks on the firmware upload process are done.

USB-C devices are cheap, and they’re made by tons of vendors, many of whom know about voltage conversion but not security. Heck, most of these vendors, even big names like Nintendo, can’t even be bothered to speak the protocol correctly.

Maybe now to make a USB-C device you'll be required to undergo HDCP-style certification. Microsoft and Apple can now decide what specific devices are permitted to be connected based on being signed and certified. You'll need approval per host manufacturer to make and sell USB devices.

many USB devices can have the entire internal hardware replaced and snapped back into thier "chassis/plastic sarcophagus" whith no authentication. if you have an environment dependent, on USB media/devices and security at the same time, there has to be some handshake that IDs hardware as friendly, or USB devices need a security redo.