If somebody is doing a distributed chat/social system, I would use ssh if I were them.
By ssh I don't mean execution commands but rather encryption/authentication framework.
If somebody is doing a distributed chat/social system, I would use ssh if I were them.
By ssh I don't mean execution commands but rather encryption/authentication framework.
There are some well known trade-offs, namely that having everyone manually verify fingerprints on initial connect and again on any server change is a large burden.
I don't particularly want to have to go into my bank's local office and verify in person the fingerprint is correct each time they need to rotate a secret.
If this isn't what you meant, that we should use TOFU vs Trusted third party, please do expand.
Only if users never replace their keys, which puts them at significant risk in the event of a key compromise.
For banks, it could work quite well. Most other people and organizations aren't that lucky, though.