[lamps] Hybrid pkix isn't needed

[Watson Ladd <[e-mail]>]

Dear all,

I don't think linking certs or special provisions for hybrid
encryption or authentication are a good idea.  A hybrid encryption
scheme should be an encryption scheme with a public and private key,
just like any other key you can put in the PKIX.

If for backwards compatibility you want to have multiple kinds of keys
just like we do with RSA and ECDSA keys in TLS, just do that! Don't
add complexities to try to link them or force people to find both keys
at once for an operation. We know that the transition model with
multiple unrelated certs works, and we have experience and fixed bugs
that resulted. Let's use that instead of have new bugs to fix.

The other thing is hybrid auth is worthless. Authentication breaks are
not retroactive: a break of an algorithm at a time in the future
doesn't threaten the security properties of authentication in the
past. That's different from encryption, where you do potentially want
to ensure a new post-quantum algorithm is no worse than a classical
one, but the case for it is fairly weak.

Sincerely,
Watson Ladd