Final Removal of Trust in WoSign and StartCom Certificates
I&#x27;m still really bummed about StartCom&#x27;s suicide&#x2F;implosion. They had by far the most sane and reasonable pricing model I&#x27;ve ever seen, and one I really wish someone else would do. They basically only charged for non-automatic authentication, not for what you <i>did</i> with that authentication, and then let each level of authentication feed into higher levels. So Level 1 machine auth (similar in spirit to LE) was entirely free, you could verify an email, domain, or whatever and then produce certs for that. If you wished you could pay money (~$60 for 2 years IIRC) to have an actual human look at your documentation and give you a call, then give you a Level 2 with your legal name. You could then use that for an unlimited number of S&#x2F;MIME certs for email accounts, domains, software signing and so forth. Having gotten personal verification to level 2, you could then pay to have an organization certified. Etc.<p>Their UI wasn&#x27;t the best, but it was functional and the overall system made a lot of sense. They didn&#x27;t put an artificial price on some bits with a marginal cost of nada. It&#x27;s a real shame all that got flushed, because that model of business filled a hole that has no general world solution right now (in principle authentication of their citizens should be a core role and offering of modern government, but I&#x27;m not holding my breath there).