But how would that help? Both Stripes would have a valid first class identity with valid keys. How are clients supposed to then check?
a) not all CAs will present enough distinguishing data to the client. Case in point: "Stripe Inc. [US]"
b) No consensus between CAs as to who will issue a cert for a given legal entity. In other words, there is such a thing as a CAA record for DNS and DV certs, but no such thing for EV certs and therefore no verification flow of for a given legal entity -> which CA is permitted to issue -> which domains have been certified for that legal entity
c) No support for more complex identity usecases including name changes, subsidiaries, brand licensing (this FedEx-looking site is run by Acme Local Fulfillment Inc. which has been licensed by FedEx to use the FedEx brand), etc.
Certificate Authorities are not in the business of establishing identity and so they are fundamentally doomed to doing a poor job of verifying identity. Instead of trying to coerce CAs into the identity business because of the inflexible and glacial pace at which government moves, we should be pressuring government to adopt more modern identification practices.
(b) Why is this a problem?
(c) Is there any evidence of demand for those usecases? How would you even present them to the users in an understandable way?
"Certificate Authorities are not in the business of establishing identity and so they are fundamentally doomed to doing a poor job of verifying identity."
I don't see how that follows. In fact, I don't see how that's even possible. Whenever you do business with any entity besides the national registry - be it a bank, insurance company, notaries, or even another governmental department - they have to verify your identity. CAs just happens to give you a digital affidavit of the results.
Instead of trying to coerce CAs into the identity business because of the inflexible and glacial pace at which government moves, we should be pressuring government to adopt more modern identification practices.
I disagree; we already have problems with too-big-to-fail CAs; governments are even worse. A CA can be told "follow the CAB Forum rules or get kicked out". But you can't distrust a government when they're the only issuer for the sites of the whole country.
Low-coupling is not just good in software development.
PayPal, Inc. # Street: 2211 N 1st St # Locality: San Jose # State: California # Postal Code: 95131-2021 # Registered: Delaware, US
And we could include other information if we needed.
For PayPal this number is 3014267 and it'll be their registration number with the state of Delaware.
The EV rules require a CA to figure out if there is such a number and if so fill it in on the certificate. If there is no number, they're supposed to write something else (a registration date maybe? I don't remember)
(Sometimes a country has some companies that are so crazy old they pre-date the idea of registering companies, or turn out not to exist in their company register because the country created them by passing a law instead of formally registering them, or whatever, and these don't have serial numbers, e.g. I wouldn't be surprised if the Bank of England has no registered company number)