If you replace "reputation service" with "certificate authority" isn't this basically SSL with both certificates validated? Which would avoid the need for a user website. Or am I missing something.