Embed Notice

@dequbed @Gaelan @theresnotime @q @izaya Sure, but SSH CAs sidestep that by… making it too simple. Because the longest possible path is Key -> CA

So my Root CA has to be online regularly to resign my actual keys, while if this were X.509 the root CA would be kept offline and I’d use the intermediate to regularly resign my end-user certificates.

(I know SSH has KRLs. They have even less deployment than X.509 CRLs, which suck)