Hacker News Reader

If you're interested in how other folks handle super important private keys, I highly suggest reading the IANA documentation on the DNSSEC Root Zone and how they manage that:

https://www.iana.org/dnssec/archive

https://www.iana.org/dnssec/ceremonies

https://www.youtube.com/channel/UChND9hEeJQjtLDFZ-m8U47A

View on HN

Also of interest:

https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/

CACert had detailed documentation on their ceremonies. They were radically transparent about the procedures around their roots. I was sad when Mozilla pushed them out of the Root Programme.

I'm not blaming Moz, CACert were breaking new ground in trying to build a transparent process for a member-run CA. I believe they failed to find a suitable auditor that didn't cost a mint, and could work within the CACert transparency constraints.

Then LetsEncrypt came along... and ate their breakfast.

Reply on news.ycombinator.com