[tialaramex]

The technology you want is Delegated Credentials:

https://tools.ietf.org/html/draft-ietf-tls-subcerts-07

The certificate is public, it's fine for copies of that to be in all edge devices, the problem today is that the associated private key has to be on those edge devices too, and that's what Delegated Credentials solves.

[rictic]

That definitely helps, at least for short term compromise of TLS servers.

[chrisweekly]

+1 x 1000 This.