23n2723n27@dgc.social
Oct 20, 2026, 3:27 PM@jaseg On the positive side. Yay transparency systems.
Replies
- 23n2723n27@dgc.socialOct 20, 2026, 3:28 PM
@jaseg That forged cert thus only works with non-CT clients. Which obviously still is a problem because that basically is everything that is not a browser.
But with MTCs that issue will also go away
- 23n2723n27@dgc.socialOct 20, 2026, 3:46 PM
@jaseg Also I think you could do something like https://git.glasklar.is/sigsum/apps/sign-if-logged for a "proper" HSM too. Probably not using Sigsum but just a generic log of payloads and HSM would only sign things that were sufficiently witnessed before. (My main gripe with the tkey is that there is no attestation path for knowing the provenance of key material it has generated)
Obviously depends on your application of this is desirable of course.