Request from WebRTC

For those who might not have been following WebRTC, they are enabling browser-to-browser real time communications, using JavaScript.   

The good news is that all WebRTC communications are encrypted with keys negotiated using DTLS (using either SRTP or the DTLS for encryption).  These keys are bound to user identities by way of identity assertions passed in SDP [draft-ietf-rtcweb-security-arch].  The challenge is that WebRTC apps want to be able to control what keys are used in the DTLS negotiation.   

The overall concept is that the app will be able to impose a key on the DTLS session, using something like a setDtlsKey() method.  The question is: Can WebRTC use WebCrypto Key objects to represent keys used for DTLS?

It appears that the answer to this question is “yes”.  The app/key separation provided by the WebCrypto API provides the layer of separation that is needed.  However, the WebRTC layer needs some additional metadata about the key:
-- Whether the key was ever accessible to JS
-- Limitation of the key to usage with DTLS

The proposal is to add information to the WebCrypto Key object to encode these metadata.

This email is intended to be a summary, with more detail to be provided in discussion tomorrow.  The main question for now is whether this seems like a current-API thing or a future-API thing.  

I would suggest that it is an issue for the current API, because (1) the proposed changes are small, and (2) if this is punted to a future version, then WebRTC will likely come up with an alternative solution.

Thanks,
--Richard