Hi Garth,
Jeffrey Walton wrote:
There are no free lunches, and key exhange [even by another name] is thorny at best
Take a look at Guttman's Home Page[^]:
Despite two decades of work, X.509 PKI isn't doing very well. Deployment is minimal, and even when it's used it's frequently just security theatre... It doesn't have to be that bad though. By sidestepping some of the most dysfunctional aspects of the original OSI design (X.500 directories, Distinguished Names, CRLs), it's possible to build a highly functional, easy-to-use PKI based on the original X.509 blueprint.
Follow the link to the paper titled, How To Build a PKI that Works[^]. Also of interest should be Guttman's Underappreciated Security Mechanisms[^]. In the paper, he discusses User Identification and Email Based Identification. Jeff