That’s a sentiment I hear a lot, and honestly, not without reason. The trust model behind public CAs is… fragile at best. Misissuances, opaque root store politics, and uneven auditing make it feel like we’re outsourcing security to a cartel.

But until there’s a widely adopted alternative (DANE, peer-to-peer trust, Web of Trust 2.0?), we’re stuck maintaining vigilance within this system. And unfortunately, the shorter cert lifecycles and increasing complexity only make that harder.