On: About Gatekeeper

[augustl]

As pointed out in other Gatekeeper threads, it would be nice if users could choose which signing authorities to trust. Signing is a good security model, but a single authority sounds risky to me. Perhaps I feel that Signing Authority Foo has a better definition of malware (read: which certificates to reject) than Apple has.

[jensnockert → augustl]

It could be useful to be able to remove the Apple root from trust as well, only running locally signed applications.

(Could be useful for public environments, schools, libraries, enterprise etc.)

[duskwuff → jensnockert]

I wouldn't be all that surprised if this were already possible through Keychain Access.

[DannoHung → jensnockert]

I wonder what the revocation API is like.

[jcromartie → augustl]

I'm sure you will be able to add certs in Keychain Access, just like you can now.