Re: [w3c/webpayments-crypto] Should we allow keys or only certificates? (#15)

Allowing only certificates that come from the merchant origin prevents the merchants processor from supplying the key and therefore put the merchant in more difficulty with PCI compliance. Also from a trust point of view the shopper is sharing their card with the merchant rather than just the payment processor. 

Enabling the pass-through of data was a key use case we were trying to enable.

However allowing certificates from other sources is a good idea. Allowing keys is a problem as anyone could have inserted that key into the payload.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webpayments-crypto/issues/15#issuecomment-394597265