In the short term - by which I mean, the next ten years - my hopes are on DNSSEC with DANE&#x2F;TLSA for DNS-based certificate assurance.  This is not a great solution: firstly, adoption of DNSSEC has yet to snowball; and secondly, DNS remains a tree with a single root controlled by a governmental authority, and it&#x27;s tough to argue that&#x27;s any better than the CAs.<p>The longer dream of a universally federated, decentralized trust mesh depends on a substrate protocol emerging for which I think Bitcoin is only the first glimmer of hope; timeframe ca.10-50 years.