Re: [lamps] [EXTERNAL] Re: I-D Action: draft-ietf-lamps-im-keyusage-00.txt

[Stephen Farrell <[e-mail]>]

Hiya,

On 17/04/2024 21:35, Rohan Mahy wrote:
> That's not what I expected. Could you elaborate a bit more on why that
> would make self-hosting harder please?

If it requires slow-to-change public CAs to do stuff then that'd
(maybe) make it more likely those who can afford to pay-per-user
get what they need.

> I was motivated to write this because my experience was the opposite. The
> feedback that I got repeatedly was "if we are going to setup a private CA
> for IM user identities we need to make sure those certs won't be confused
> with/interpreted as regular TLS certs" and related variations.

I agree that this'd be neutral wrt self-hosting for home-grown CAs
for a single service. But it might also make it harder to federate
(or whatever ends up being needed for MIMI to enable alice and bob
on different services to verify one another).

Note that I'm not claiming this is a winning argument. I'd need to
think it through more myself to reach a conclusion, but not making
self-hosting harder is a concern - I'd prefer we make that easier.

Cheers,
S.