Suppose in a future version of x509 PKI, it is possible to limit the quantity of certificates being used, what would that look like?
Here is a concept that won't work in the real world, but illustrates what I'm trying to do:
- The child CA sends a list of primes to the parent CA (the prime is the public key of an issued certificate and therefore unique)
- The parent CA checks the quantity of primes, and if it's less than the license threshold, it creates the product of those primes. (quasi-commutative hash)
- The parent CA signs the result of #2
- Each validator (web client) gets the signed result of #2, and ensures membership of the public key in the accumulator
The reason I ask is because I'm working with a different crypto system developed by a 3rd party, and was told I need to constrain its usage somehow. The design of the 3rd party system is similar to PKI, and therefore many of the thoughts are transferrable.