So people working in one space (logic) and those working in functional programming are
quite likely to be discovering the mirror images of what the other is discovering without
recognising (until it is pointed out) the existence of the other side.

Still, in more empirical disciplines like the one under discussion here someone can end up following a conversation by living it. I picked up a lot of the elements of the conversation by being part of them since 1993. 

However, I agree this is a complex field full of snakes and subtleties, mirages, big egos, paranoid
souls, fake news, false problems, hidden answers (sometimes hidden for all to see as illustrated
by Edgar Allan Poe's Purloined Letters),  ... there is much room for misunderstandings.

One can cut through a lot of the details with a mathematical perspective on things,
as I will try to show. 

Similarly, given that Symantec has left the PKI business after a series of failures, it’s unclear if you’re speaking of the current entity or the former.

I just said I have kicked the tires a bit, not that it has gone through a full review. 
The Spamsolution questionnaire would make sense as a first mail to send someone who
had not thought about the problem at all, as an incentive to get them to kick the tires.
Dave Crocker does not know me, nor if  I did some initial work on the topic,
so I am ok that he sent it out. It's quite funny actually.

The question of an interrelated distributed set of links - and of authority for different name spaces - is not new or original in this space. It’s true whether you look at the Web of Trust or when you consider the PKI’s support for mesh overlays with expressions of degrees of reciprocality of trust.

Similar, the suggestion of recognizing the different “organs”, as you suggest, for different degrees of validation is also not new. You can see this from the beginning of the X.509 discussions, in which ITU-T would maintain a common naming directory from which you could further express these links in a lightweight, distributed directory access protocol.

Well there has been a lot of progress in decentralised data since ldap which is a pre-web 
technology that dates back to the 1980ies. But you are right a good thesis would need to 
look at what the advances in this field of linked data have been and why things could not 
be done then that can be done now.

There is, underneath it all, a flawed premise resting on the idea that X.509 is even relevant to this, but that criticism could easily occupy its own voluminous email detailing the ways in which certificates are not the solution here. The basic premise - that what we need is more information to present to users - is itself critically and irredeemably flawed.

X509 is not necessary at all to my argument. It is relevant only insofar as X509 certificates are currently deployed in the browser. You could move to RFC 6698 (DNS-based Authentication of Named Entities (DANE))  and you would have the same problem, which is that all you would know
about a server is that you have connected to it. Ie you just know this:


<CompaniesHouse-urlbar-reference.gif>


But what people in the real world need to know is the full web of relations 
that site has to legal institutions they can go to if they want to lodge a
complaint.

This is a flawed premise though. Certainly, if you’re talking to CAs wishing to sell EV certificates, they would be inclined to tell you that, but this is something that’s been fairly plumbed in the spam side.

What I am proposing is not something that EV Certificate authorities can offer.  It is quite simple to explain why this is so.

A certificate is an algebraic construct: it is a syntactic structure that is signed. 
A Signed Document to use ordinary language. Certificates can't change, and EV certs
are expensive.  (500-2000 dollars a year) So you don't want to change them every
day. As a result:
1) you try to put the longest lasting information in there that you can
2) as it is expensive to verify information (especially if you are not the source of it), very little information is placed in the cert
3)  because CA's can certify domains the world over, the weakest CA can bring everyone down, as Dan Kaminsky has argued forcefully in many talks.

Imagine you wanted a very rich and hence humanly interesting certificate, that contained not just the
location of your company headquarters, but the name and homepage of the owners, what their
stock market value was, the legal problems they have, what is said about them in the news, where
their local stores were etc.... 

This would require 
1) an extensible certificate format, which X509 based as it is on ASN.1 cannot provide. 
You'd need something built on RDF  which is what the Verifiable Claims Working group is working on.
  https://www.w3.org/2017/vc/WG/
2) Even then the more info you placed in the verifiable claim, the more often it would need to be updated, and the more expensive the update would be, as it would make the CA liable for all 
the claims in it.

So it does not make sense to put much information into the X509 Certificate or the verifiable claim. (Which is not to say that Verifiable claims will not be very useful)

However, if instead of going through an intermediary CA one went directly to the legal institutions responsible for collecting taxes, verifying companies, that had the legal infrastructure to arrest people, take them to court as well as to defend them, then the cost of maintaining this information would be exactly in the right location. The institutions designed to do this already exist, and you already pay for them through your taxes. 

What I am proposing is to allow companies that so desire to tie their domain to such a 
legally empowered registry such as  companieshouse.gov.uk in a way that does not require there to be a central registry for everything but allows browsers to follow a chain of trust to the trust anchor chosen by the user. The domain would link to the resource in
the linked registry that describes the company. This information is a web resource.
 A web resource is co-algebraic: it lives in the exact opposite category of algebras. 
Coalgebras describe processes, infinite lists, streams, etc... URIs refer to resources and resources can change. They can return different representations (which are algebraic structures) 
at different points in time. Once you realise that the web is a coalgebraic system, you can see that you need not tie yourself to certificates for every part of your architecture.
You can use the web too.

There’s a whole host of problems with this - ranging from the Web’s distributed nature (one bad JS can compromise you),

You take into account where all the resources came from when building a UI of the reliability of a page. That is what is done at present, with the minimal information available. However, I agree there would be extra research to be done for applications
that need to fetch data across different websites. That is undoubtedly an extra UX challenge.
However, you cannot start off by saying that it is an impossible one to solve (unless you have a 
mathematical proof of that)

it’s ephemerality (are you going to record every certificate you encountered in a transaction),

You put ephemeral information on the web into resources that can change, with a short time to live on the representations. Certificates are pretty small and long lasting in comparison, and quite easy
to store. 

it’s jurisdictional independence (what happens if Tonga says phishing isn’t a problem?

Then your government cuts the link to Tonga, and browsers that go to those websites no longer find the meta information about the companies there. Alternatively, if a full trade war is not something
your country wants, a method could be devised for it to add a warning to any websites linked to a Tonga registry to make you aware of the problem, and to let you know that if you enter into a transaction with them, you will not be covered by the diplomatic power of your state.

You’re either trying to find political solutions or technical, and both are deeply flawed in this).

Neither technical nor political solutions alone can work, as this is a socio/technical problem.

We are proposing to build on the institutions that exist, and that whether you like it or not, 
you are dependent on (for education, law, military, etc...). We may not like the fact that the USA has the most significant military in the world (bigger than the military expenditure of the next 17 nations), but that is the way things are. This money is used to sponsor computer companies by
creating colossal military based markets in which those companies can grow to sizes that give them very
substantial competitive advantages. This is then cleverly disguised in a free market ideology that tries to hide this political reality to gain political advantage. 

While you suggest it’s not dependent on X.509, the entire proposal is devoted to discussing this and its relationship to EV. If your goal is merely to provide a federated identity clearing house, well, that’s been explored to - in the context of eIDAS or things like Microsoft’s Passport/Identity Cards.

For eIDAS I doubt they have tied this into an institutional web of trust as I describe. I am sure that this has not been implemented in the browsers. My proposal is one that is completely web friendly using only W3C and IETF standards. It may be able to tie into and enrich eIDAS. I'll look into that.

As for Microsoft Passport one Wikipedia says: