Digicert Withdraws from the CA Security Council
Note that this is not the CA/Browser Forum, the usual industry association you hear about. The CA Security Council is a group of a small number of old-guard CAs, which has been notable recently for pushing a distinction between (automatic) domain validation, organizational validation, and Extended Validation, mostly as a response to Let's Encrypt. The "London Protocol" appears to be a proposal for formalizing the distinction between DV and OV + EV: <a href="https://casecurity.org/2018/06/27/the-london-protocol/" rel="nofollow">https://casecurity.org/2018/06/27/the-london-protocol/</a><p>If you look at this previous paper they (Entrust + Comodo) published, they're proposing that OV and EV certificates get padlocks and DV ones don't: <a href="https://casecurity.org/wp-content/uploads/2017/09/Incidence-of-Phishing-Among-DV-OV-and-EV-Websites-9-13-2017-short-ve....pdf" rel="nofollow">https://casecurity.org/wp-content/uploads/2017/09/Incidence-...</a> Or, in other words, you can't get a padlock from Let's Encrypt and you'll have to pay them for a padlock.<p>Compare with Google's plan at 
<a href="https://blog.chromium.org/2018/05/evolving-chromes-security-indicators.html" rel="nofollow">https://blog.chromium.org/2018/05/evolving-chromes-security-...</a> which just drops the padlock for <i>everyone</i>, treats plaintext HTTP as affirmatively insecure, and stops pretending that paying money to a CA means that you're a morally upright website.<p>A CA leaving the CASC seems like a good thing for the world.