Subject: [websec] Brief comments on draft-evans-palmer-key-pinning

From: Martin Thomson <[email-masked]>
Date: Wed, 23 Nov 2011 09:58:36 +1100

It would be helpful if the document described the expected recovery
process after loss/compromise of the main key.  I expect this is as
simple as: use backup, send header with hash for new key(s).  That is,
the process by which a new key can be deployed in general.  The
document doesn't really talk about how clients are expected to react
to a changed header.

Can the header be shortened to something that takes fewer bytes like 'Key-Pins'?

--Martin