CAs are insecure. Nobody is arguing otherwise.<p>The problem is that you can&#x27;t mitigate insecure CAs by adding a new set of irrevocable government-controlled CAs.<p>That&#x27;s the point &#x27;idlewords is making. Right now, the DNS does not function as a sort of distributed CA. But that&#x27;s exactly what DNSSEC asks it to do.