Hacker News new | ask | show | jobs
by doomrobo 1865 days ago
> having Cloudflare as the sole judge of the trusted key set

The article doesn't say so, but the approved vendor list is actually not determined by Cloudflare. They defer to the FIDO Alliance's Metadata Service [0], which maintains a list of certified suppliers.

[0] https://fidoalliance.org/metadata/