> Who are "they"?
A court seizing a domain thereby invalidating a cert.
> What do you mean "listen"?
If I accept a custom cert, but don't validate the key, I might as well use none, basically. That's the extent of my knowledge, I don't know what Certificate Transparency is doing, for example.
> The CA system has lots of issues. It would be a pretty big conspiracy if there were thousands of people that knew of something better and said nothing. But, there is absolutely no proof that anyone has any idea how to do better than the CA system. Do you know of such a system or have any evidence that someone else does?
> It would be a pretty big conspiracy
Exactly, so why do you expect that twitter sized post could it explain it convincingly?
> if there were thousands of people that knew of something better and said nothing
Ironically, it might be the ability to censor communication to suppress such voices, however hypothetical that is, that triggered the GP.
> But, there is absolutely no proof that anyone has any idea how to do better than the CA system.
PGP is used with key exchange in real live. I'm not using it, just arguing for the sake of the argument. It has problems, too, but "better" is not a binary value , except in the limited scope of the specific problem. PGP doesn't need root CAs.