[Dance] Benjamin Kaduk's Yes on charter-ietf-dance-00-01: (with COMMENT)

[Benjamin Kaduk via Datatracker <[e-mail]>]

Benjamin Kaduk has entered the following ballot position for
charter-ietf-dance-00-01: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)



The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-dance/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

    The DNS namespace, together with DNSSEC, forms the most
    widely-recognized namespace and authenticated lookup mechanism on the
    Internet. DANE builds on this authenticated lookup mechanism to enable
    public key-based TLS authentication which is resilient to impersonation,
    but only for TLS server identities.

We might reference RFC 6698 for DANE.

OVERLY PEDANTIC NITS

    The process of establishing trust in public-key-authenticated
    identity typically involves the use of a Public Key Infrastructure
    (PKI), and a shared PKI root of trust between the parties exchanging
    public keys.

"shared PKI root of trust" seems to imply that both parties have
credentials that chain up to the same root of trust (or at least that
the level of trust in the root is shared between parties), which need
not be the case.  In principle the parties can use credentials anchored
at different roots of trust, so long as the verifier is willing to use
the corresponding root of trust for this purpose.  So we might say
instead "and a root of trust deemed valid by the entity validating the
authenticated identity".  Or we could ignore it, and try to not be
overly pedantic.