[gh02t]

Thanks for the clarification, I was pretty confused by the article on this detail myself. Per app opt seems like a reasonable compromise for my use as long as the browser recognizes my CA, as that's the one I care about.

[jeroenhd]

The biggest issue is that the developer needs to opt in, the user can't decide "my email client should trust this certificate".