[Webpush] Application server authentication new years edition

[Martin Thomson <[e-mail]>]

With Peter's help, I've just submitted a new version of a draft that
attempts to enumerate the options for application server
authentication (issue #44).

  https://tools.ietf.org/html/draft-thomson-webpush-vapid-01

This assumes the following requirements:

1. A push service would like to be able to correlate requests from a
particular application server over time.

2. A push service would like to be able to contact the
operator/developer of an application server.

This takes the position that any correlation or contact information is
provided voluntarily by an application server and that we don't
require strong authentication for application servers.

Both Ben and Costin have suggested that we could (SHOULD?) construct a
scheme to strongly authenticate servers.  Ben observed that most web
push consumers will have HTTPS endpoints with valid server
certificates and we could use that to construct a system that strongly
authenticates senders.  That might be possible, but it's likely to be
a complicated system that introduces a whole new set of technical,
operational and privacy problems.

The voluntary authentication incrementally improves the situation and
allows us to build stronger authentication systems on top in future.
I think that we should look at doing that, but I would be opposed to
anything that made a more heavyweight authentication system mandatory
to use.

So I come to the question:  what levels of authentication do we want
to support for application servers?

  A. anonymous/none - push without being authenticated

  B. voluntary authentication - as proposed in the draft

  C. strong - proposal TBD