If one CA fails, it can still issue certificates for *all* domains. You can’t av...

		teddyh on March 28, 2023 \| parent \| context \| favorite \| on: We need better support for SSH host certificates If one CA fails, it can still issue certificates for all domains. You can’t avoid any bad CA by using a good CA; any other bad CA can still issue certs for your domains. The CA system as a whole can only ever be as good as its worst CA.