On certificates and validation

[Drew DeVault]

On Thu Nov 26, 2020 at 1:41 PM EST, Michael Lazar wrote:
> Now you're talking about CA verified certificates. There's nothing
> wrong with using self-signed CAs, but it's a completely different
> security model than TOFU and shouldn't be confused with it.

Mostly correct. What we have is TOFU on top of TLS, not just TOFU. And
because these parameters are present, it's likely that someone may rely
on them. And if they do, and put their personal security on the line for
it, then we can hardly call that a mistake.

Gemini uses TLS. That comes with warts. That's life.