> I understand the difference, and the condescending snark is not appreciated. I don't think the difference is very important in this case.
As an example, you wrote earlier:
> In fact, we see some of this in TLS - not everyone can participate
As written this is nonsense of course. TLS is a series of published standard protocols, everyone can "participate" by implementing one of the protocols, and at their option some or even all optional extensions.
But for the Web PKI things are quite different, only some can participate and under exacting conditions. On one side, Certificate Authorities can only participate via the root trust programmes of key trust stores operated by Mozilla, Microsoft, and Apple, plus Google (for Android and, perhaps sooner or later, Chrome) and Oracle (for the JRE). Participation in these programmes requires obeying the CA/B BRs, but also is at the sole discretion of each programme operator and so their own policies apply†
As subscribers, the Web PKI is only interested in certifying names in the Internet's DNS hierarchy and, to a small extent in the Internet's IP address hierarchy. Other names aren't actually certifiable in the Web PKI, sometimes to the surprise of would-be subscribers (and even, once in a while, CAs)
Finally as a relying party (the role all of us occupy even if in addition to other roles) the Web PKI is only applicable to the Internet, which of course is a lot of things but it isn't everything.
> It's also revealing, perhaps, that you don't understand that the "Web PKI" is used far and wide in domains outside of the web.
That's true, and has been for many years, and yet, there's a reason it's named the Web PKI anyway. Notice the B in CA/B stands for "Browser" even though today these are (except Mozilla) operating system vendors, historically they're the browser vendors. You could imagine alternate worlds where say, IBM, Apple and Sony are the biggest players in CA/B instead of Mozilla, Microsoft and Apple, and it really isn't about the web at all, but they're quite different from our world.
If you don't like the phrase "Web PKI" you could sometimes substitute PKIX, but, ultimately PKIX isn't quite the same thing. PKIX is technical, it explains how to use the X.500 system's certificate format (X.509) to talk about the Internet instead of the X.500 directory, but it makes few substantive policy decisions. Certificates you get from Let's Encrypt are PKIX certificates, but, the ones you mint for testing with self-service tools or that come supplied with many Linux installs are also PKIX certificates and those aren't trustworthy. Certificates from Let's Encrypt are also part of the Web PKI and that's why you trust them.
† These policies can be quite significant, for example Microsoft's programme requires that participants agree to revoke certificates if Microsoft so chooses. In practice Microsoft seems to use this power to kill off certain types of phishing scam that attack Microsoft's products. Mozilla's programme has historically been the origin of a lot of important public policy some of which is now in the CA/B BRs.