Resting our whole authentication framework on PKI isn't the right way
to go about things. Read Ellison and Schneier, "Ten Risks of PKI":
http://www.schneier.com/paper-pki.html
I would much rather see an SPKI-like approach to naming, in which we
use local information to bind locally meaningful names to public
keys. This is a far better fit to practical security problems. At
the very least, if you can persuade yourself to think the SPKI way for
a moment it will give you an entirely different perspective on many
issues to do with naming.
See also Zooko's triangle:
http://zooko.com/distnames.html
--
__ Paul Crowley
\/ o\ sig(_at_)paul(_dot_)ciphergoth(_dot_)org
/\__/ http://www.ciphergoth.org/