alt Hacker NewsWhy do agents need any of this cryptographic infrastructure? Can't they just check on the certifying authority's website whether an entity is legitimate?
Why do agents need any of this cryptographic infrastructure? Can't they just check on the certifying authority's website whether an entity is legitimate?
It's not so simple:
- If by certifying authority you mean a CA/Trust Service Provider, they don't generally publish client information in a central location.
- If you mean the actual jurisdictional authority, there are thousands and public records are all over the place.
- Websites aren't generally part of corporate filing records. So the agent would still need a way to connect the website to the corporation even after checking the legitimacy of the corporation.
- Serving the structured info in an HTTP header that is cryptographically verifiable by the browser itself (via its trusted roots) essentially serves as a distributed database for website identity, which eliminates the need for each agent to come up with its own ad-hoc verification system on the fly (and all the additional fetches that come along with it)