Kevin Karhan :verified:<p><span class="h-card" translate="no"><a href="https://chaos.social/@LaF0rge" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>LaF0rge</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@sysmocom" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>sysmocom</span></a></span> granted, I do trust the GSMA more than Beijing, but that's more due to the fact that conflicting desires if GSMA members tend to be harder to steer.</p><ul><li>Similarly GAFAMs conflicting ideas prevented them from enshittifying Linux.</li></ul><p>Still, I think that end users and device integrators should have full control over the certificates and root of trust, including the ability to add alternative Root-CAs and even removing GSMA's Root-CA (similar to how <em>"Secure Boot"</em> should've been done instead of <a href="https://infosec.space/tags/CensorBoot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CensorBoot</span></a>!) </p><ul><li>Whether it would be a wise decision to yeet the GSMA cert is a different story, but given what I know in terms of <em>"security"</em> I'd certainly not trust <a href="https://infosec.space/tags/Bundesdruckerei" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Bundesdruckerei</span></a> and it's subsidiaries to be competent.</li></ul><p>Certainly being able to exercise full control would make a lot of <a href="https://infosec.space/tags/osmocom" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>osmocom</span></a>'s development easier.</p>