[routing-wg] Re: policy proposal: "Automatic Revocation of Persistently Non-functional Delegated RPKI CAs"

tim, lots of good points

It requires that the parent CA (RIPE NCC in this case) monitors the repositories for member CA certificates that it issues to delegated CAs. These CAs may use the Publication-as-a-Service (PaaS) provided by RIPE NCC, or they could run their own publication server.

i am of two minds on this. while i like publication at reliable PPs, i am not fond of over-centralisation and spsof. originally, we hoped for a dozen or two PaaS providers. randy