Here's my view. I recently wrote an article on my blog (http://ledgersmbdev.blogspot.com/2013/06/tangent-design-thou...) which was on the front page of HN for a while. I want to summarize both my thoughts again and things that have occurred to me after writing it.

All of our existing key interchange systems are amazingly brittle. With X509, there's no reason to assume the NSA couldn't order verisign to produce a certificate for any given individual or site which they could then use to orchestrate a MITM attack. Purely synchronic protections (i.e. focused exclusively at the moment of exchange) are obsolete in my view. Similarly purely diachronic protections have problems too, and often aren't well implemented. Suppose you need to rotate ssh host keys. This becomes a problem. I think we need something a lot better.

Regarding PGP, the question is what they can break. Could they get a court order to force MIT to help them present that your key on their directory is visible to you but their key is visible to everyone else (allowing them to step in between and conduct another MITM attack of another variety?

Even if you add endorsements (web of trust model), how easily can that be attacked? It might be harder but not that much harder.

So my thinking is this. Start with a standard PKI model and extend it to require evidence of continuity. The assumptions required to do this are:

1. No external authority issues private keys, and

2. You must retain and continue to use an old private key for an unspecified transition period (possibly spanning several keys). This shows a chain of issuance, and evidence that the same entity controls the same internally issued private keys over time.

So suppose you define a transition period of 2 years and a key rotation period of one year. This means that anyone you have been in communication with over the last three years will be able to check that the continuity of key possession has not changed, and three keys would have to be compromised to force a certificate believably (two of those keys can be stored somewhere else and only used for the certificate resigning process) If a MITM attack starts, anyone who has been in contact in that period knows instantly that something is wrong. Newcomers get alerted when the MITM attack stops.

I would recommend looking into what we can do to implement a system like that. I am thinking of trying to write it up as an RFC and submit it to the various bodies.