It's sad because they can do good investigative journalism. They took the lead in the Panama Papers case, the hockey canada and Miller sex scandals, recent Indian and Chinese interference, and many more.
The problem might be that this doesn't even need investigation. It's too boring. Everything is said in the bill. They just lack technical literacy to realize the implication.
My guess is that the legislators are completely ignorant of the technical implication of weakening the entire chain and the media are just as ignorant.
It's actually quite defensible from their perspective. They justify it with reason they decided wire tapping was reasonable for the past decades. It's just that they don't understand the risk and implication.
I didn't express myself well but what I meant by force is that by building a standardized to automate way manage certificate, ACME imposed itself and became mandatory.
Previously, most CA had no programmatic way to order certificate, it was all done manually.
As far as I know, the only providers with that would let you automate certificate provisioning at the time where Comodo, GlobalSign and Digicert.
At first none of them were warm at the idea of providing an ACME endpoint. I'm assuming part of it is the cost of implementing it but they probably liked the stickiness of their custom APIs too tied to million dollars contracts.
Nowadays they all implement ACME. At some point, they where effectively forced to implement it to acquire new customers and keep their existing base around because nobody would accept poorly designed custom made protocol anymore.
Not sure if there is a point to "keep things in Europe" when it come to certificate authority.
- LetsEncrypt don't have the private key tied to your certificate
- Any of the Certificate Authorities could potentially emit unauthorized certificate
Your only protection for all of these problems is HPKP. If you prefer to keep things in Europe, keep that pinned private key in Europe, but the rest doesn't matter.
That said, it's pretty nice that LetsEncrypt forced the ACME protocol on this industry. Not only it create redundancy with mostly interchangeable alternatives but before ACME, there was no way to fully automate certificate provisioning cleanly.
It was a red herring the entire time. At Shopify we made experiment regarding conversion between regular certs and EV before they stop being displayed and there was no significant difference. The users don't notice the absence of the fancier green lock.
The problem might be that this doesn't even need investigation. It's too boring. Everything is said in the bill. They just lack technical literacy to realize the implication.