UriSchemes/httpsy
This specification defines a mechanism for identifying and authenticating an HTTP server based on the hash of a public key, instead of a certificate from a certificate authority.
The existing standard for using encryption and server authentication with HTTP is HTTPS. HTTPS identifies a server by a DNS hostname. A certificate, signed by a trusted Certificate Authority (CA), binds a public key to the DNS hostname. The httpsy URI scheme defines an alternative server identification and authentication mechanism that does not depend on centralized, third party administration. The HTTP extension, HTTPSY, uses a public key hash, instead of a DNS hostname, as the URL authority. This mechanism binds the URL authority to a public key without use of a trusted third party.
The decentralized authentication model implemented by this specification is defined by the y-property.
The specification Abstract:
A target server is identified by the hash of a certificate issuer's public key. A client locates a server using a list of network location hints. These location hints may provide the location of the target server, or the location of a redirection server which redirects the client to the target server. Once the target server is located, the client completes a mandatory upgrade to TLS/1.0. Before sending a resource request, the client authenticates the target server by constructing a valid PKIX certificate path to a certificate that is signed using a public key having the expected hash.
putting the key ID in the URI seems (to DanConnolly) nifty. I wonder if things like the "principle of least privelege" are written up pattern-style anywhere, or deserve a page in this wiki.