> I think there is still an assumption in the DNSSEC specs that local > validator policy always wins. I sense your suggestion is along those lines. >
It's not about policy, but about keeping things simpler. Fundamentally the security of any authentication does not depend on how strong the proof of the legitimate authenticatee is, but rather what the weakest proof is that the verifier is willing to accept. [1] Best, Bas [1] Sounds obvious, but it's a common misconception that only having PQ TLS certificates installed on your web server makes it PQ secure. Instead it's about what the TLS client is willing to accept.
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
