Wanted to share a quick blog post (see link) playing around with a couple methods of validating data origin and integrity without blindly relying on public CAs.
It’s sort of a follow-up-to-a-follow-up on an earlier post about using Cloudlfare proxies to selfhost personal sites or services, but it really applies more to TLS and public CAs in general.
If there’s a concern that an adversary can rewrite hashes then why is there not a concern the public key could also be rewritten and the hashes signed with the fake key?