First, thanks for the careful response. You and I argue in much the same manner as pure sodium argues with water. You're being nicer than I am this time.

Second, the point of posting a catalog of vulnerabilities encrypted under the RSA keys of vendor SSL certificates is that the vendor can authenticate a posting; the vendor, after all, is the only party that can decrypt them. I think we're clear on who the actors are here.

You appear to be trying to build a system that exerts pressure on vendors to fix and publish security findings by allowing researchers to safely claim publicly that they have findings.

But researchers already have several tools for doing this. One of those tools (my least favorite) is things like the ZDI, where you are paid hundreds or thousands of dollars to let a big company handle the problem for you. Another popular solution that has the virtue of simplicity is, again, simply posting a SHA-1 hash of your finding, like, "ad1ad1ccb6da145406edef884e0595b4b1f5c4ae IE8".

The latter solution is exactly as amenable to pressuring vendors as "vulnarb.com" is. You can even help. Just collect and aggregate those reports. No public key cleverness is required.

My read on you --- and please take this as a compliment --- is that you are a cleverness junkie. The trick of sending encrypted messages using SSL certs instead PGP or S/MIME is indeed clever. But not every clever solution serves a real problem.