Right, that's another reason it would be good to have non-US competition.

It's not LE's fault or anything they can do about, but there's plenty of reasons to have alternative options.

Start a LetTheRestOfUsEncrypt.org based in a different country whose government isn't so full of themselves?

Or better yet, is there a way to start a decentralized organization itself so that no jurisdiction has absolute power over it?

How are you going to trust that decentralized org? Is it just voting? Can we all vote to revoke anyone's cert at any time for no reason? What happens when someone performs a 51% attack and takes over google.com's cert?

CAs exist solely because you CAN trust them, otherwise what's the point? We'd just have every site self-sign and let the users choose who to trust.

> CAs exist solely because you CAN trust them, otherwise what's the point?

That's the idea, but in practice, I don't really trust the vast majority of them.

My thinking was that it would be similar to a GPG trust network.

We’ve seen nearly 30 years of web-of-trust failure and yet you still think it’s a workable idea?

As far as I am aware, the only organizations that aren't under the jurisdiction of any nation state or authority are those sponsored by/derived from the United Nations.

Sure, but it would be reasonable for an outfit to (seek funding for) a CA that isn't subject to US sanction rules.

Of course there's a question of where you should put such a thing. Even Russians apparently don't find the idea of a Russian CA trustworthy (they expect that Putin would have his thumb on it, and who am I to argue?), a European CA is certainly not free of American influence, so where would this alternative be based? I don't have a good answer.