Re: [Suit] Surprising push back on the need for a customer to verify the trust relationship between a software supplier and software signer during digital signature validation on signed code

[Phillip Hallam-Baker <[e-mail]>]

I strongly disagree. Given my history of involvement in the WebPKI, I am
certainly not biased against CAs. My concern is different.

I see multiple concerns:

1) Every software distribution MUST be signed without exception

2) All software executables and data installed on a machine MUST be signed
by the provider.

3) All signatures MUST be under keys that have a trustworthy credential.

The reason I reject (3) is because I insist on (1) and (2). I want every
piece of software to be signed on every machine without any exception
whatsoever. That includes every development build, every open source
project, every script written by the user. And that should apply to every
desktop, laptop, tablet, mobile etc.

Thing is that I can't have the strong signing model I want if I also insist
that every credential be an EV signature. It is one or the other. I choose
everything signed.


For critical infrastructure devices, I suggest the following:

0) Must identify such machines and label them prominently

1) Software must be signed under trustworthy credential

2) Platform must verify signature before executable is launched.