* Phillip Hallam-Baker: > OK, how do you do that if the ICANN root is baked into your broadband > router? How about a light switch? Nowadays, there are software update protocols for broadband routers, too. > You can change the signing key, but distributing and embedding the > verification key is a whole different issue. The reason that VeriSign > can charge a premium for certs is because its verification roots are > the most widely embedded. No, Verisign's pricing is based on branding. "Verisign" is just the most valuable brand, so certificates associated with it cost the most. Verisign also issues certificates under a root called "Equifax", which are far cheaper but functionally equivalent. _______________________________________________ Ietf@xxxxxxxx https://www.ietf.org/mailman/listinfo/ietf