The current way cross-signing works is almost an accident, and only works for intermediate certificates. Because the 'signing cert' is looked up by name. An intermediate cert can be published twice with the same name, same key, but different signatures and signing cert. Hence doing this for a leaf certificate would mean 'just get two certificates'.
I remember around the time of the diginotar horrors looking at DANE and DNSSEC. As I understand it, DANE still isn't supported by browsers, and DNSSEC is still in a pitiful state.
Another day in tech, another deep sigh.
Also:
2016: https://news.ycombinator.com/item?id=10839315 (68 comments)
2017: https://news.ycombinator.com/item?id=15838324 (10 comments)
12 years ago, that meant something different.
So if it was Honest John you would be okay with that?
> Do we want such content here (I'd say no)?
You have 'flag' and 'downvote' buttons for this.
