ECDSA Root and Intermediates

[tdelmas]

@jsha

We hadn’t planned to publish a draft hierarchy before the ceremony, but that’s an excellent idea and we’ll do it. Thanks for suggesting it! We will also generate a fake version of that hierarchy and make it available on staging as you suggest.

Perfect!

@jsha

We could request a DST Root CA X3 cross-sign on ISRG Root X1, which would then pass on trust to the new ECDSA root.

I'm not sure it's technically/legally/contractually possible but a cross-sign from a Let's Encrypt intermediate already cross-signed by DST Root CA X3 should is probably another solution (but maybe not a good one, as it's add a level in the chain to send, which increase the handshake size, where one of the objective of ECDSA is to reduce it.)

@jsha

I’m going to be focusing on SCT stuff today, but will circle back to this soonish.

Yes! Of course, it's the priority without any doubts. These questions just needed to be asked before it was too late and some irremediable steps took place.

Thanks a lot for these answers, and all the awesome work you all do, making the internet a safer place!