Hacker News Reader

Firezone employee here. I believe we have an idea to let customers sign their keys so that they don't need to trust our portal not to rewrite keys. This is probably the same idea Tailscale hit on.

(I can't find this idea in the issue tracker and I don't think it's on the roadmap yet, but we've discussed it.)

Unfortunately there is a big convenience-security tradeoff, managing your own keys and certs is a lot of work.

> maliciously exchange keys with rouge devices

Companies are slow to respond to the growing threat from adversarial make-up brushes.

I live by but two rules, private keys stay on the storage device they're first saved to, and makeup stays with the first person to use it.

Why somewhat? The client has to sign the key, and Tailscale can’t add public keys to the network.