Subject: AW: AW: self-signed TSA [Was Re: Private Key Cloning]

From: "Peter Lipp" <[email-masked]>
Date: Fri, 23 Jun 2000 23:34:22 +0200

> I guess the problem is a common misconception that a TSA is always a
> subsidiary/sub-service of a CA. Not necessary. TSA is/can_be a service on
> its own, with no inherited relationship to any CA at all.
Sure it can. But I bet it still will have certificates from some CA (more
than one maybe) that trust the TSA for doing their service properly. Do you
really believe the average user will and can go and check for each and every
service provider if it should be trusted? If he at some point really
consiously decided to trust a certain CA, it will be close to a miracle.
Most will accept somebody elses decisions, maybe preconfigured by the
vendor, and if the SW asks: should I trust, he will hit the "never ask me
that question again" button....

Peter