Hacker News Reader

If more than one signature was allowed on a certificate, then sites would be able to have more than one path to the root. Then it wouldn't matter if any single CA was removed, giving people time to obtain new signatures.

View on HN

Agreed, but I think it should go a step further. Browsers should require 2 signatures from different regions. That way a government can't pressure a single CA within their borders to issue rogue certs. 2 signatures would be minimum with 3 for redundancy.

Agreed: this is a major operational flaw with deployed PKIX.

It has many unintended consequences, for example it's especially a pain with UEFI Secure Boot.

Reply on news.ycombinator.com