> And it means that relying on a https
> connection to browserid.org to verify the user's identity assertion
> token is out. (Well, it's probably out anyway, since it relies on https
-> CA security as the only security in that part of the protocol. I'm not
-> impressed by the documention using *curl* for this, which won't even
-> validate the certificate AFAIK; and I don't trust https to random SPoF sites
-> for security.)
+> CA security as the only security in that part of the protocol.)
>
> This seems to need an implementation, in perl or an externally callable
> program (haskell would be fine ;),