[arin-discuss] Question about the ARIN Relying Party Agreement - RPKI 'everyone must sign' and such...

[Christopher Morrow]

On Wed, Dec 5, 2012 at 5:47 AM, John Curran <jcurran at arin.net> wrote:
> ...
>    A certificate user should review the certificate policy generated by
>    the certification authority (CA) before relying on the authentication
>    or non-repudiation services associated with the public key in a
>    particular certificate.  To this end, this standard does not
>    prescribe legally binding rules or duties.

that's a bummer ;(
Do other certificate/CA people require you to download and agree to an
RPA-like thing before using their services? (I'm thinking of like
Thawte, CN-NIC, Verisign^H^H^H^H^HSymantec, GlobalTrust, etc?) I don't
think they do, why don't they? Their certs could be used to sign
things on 'emergency services/etc' things, no?

I'm concerned that we're being more cautious than is reasonable, and
imposing some odd constraints/requirements on the global userbase.

-chris