-[The Perspectives project](http://www.cs.cmu.edu/~perspectives/) at
-CMU has released an [openssh client that uses network
-notaries](http://www.cs.cmu.edu/~perspectives/openssh.html) to bolster
-your confidence in newly-seen keys. This offers a defense against a
-narrow MITM attack (e.g. by someone who controls your local gateway)
-by simply verifying that other machines from around the network see
-the same keys for the remote host that you're seeing.
-
-This tactic is quite useful, but doesn't take the system as far as it
-could go, and doesn't tie into any existing web of trust.
-
-Some concerns with the Perspectives OpenSSH client:
-
- * This client won't help if you are connecting to machines behind
- firewalls, on NAT'ed LANs, with source IP filtering, or otherwise
- in a restricted network state.
-
- * There is still a question of why you should trust these particular
- notaries during your verification. Who are the notaries? How
- could they be compromised?
-
- * It only provides infrastructure in one direction: the user
- authenticating the host by name. There is no mechanism for dealing
- with identifying users by name, or allowing users to globally
- revoke or change keys.
-
- * It doesn't provide any mechanism for key rotation or revocation:
- Perspectives won't help you if you need to re-key your machine.
-
-### OpenSSH with X.509v3 certificates ###
-
-Roumen Petrov [maintains a patch to OpenSSH that works with the X.509
-PKI model](http://www.roumenpetrov.info/openssh/). This is the
-certificate hierarchy commonly used by TLS (and SSL).
-
-Some concerns about OpenSSH with X.509v3:
-
- * the X.509 certificate specification itself [encourages corporate
- consolidation and centralized global "trust" because of its
- single-issuer architectural
- limitation](http://lair.fifthhorseman.net/~dkg/tls-centralization/).
- This results in an expensive and cumbersome system for smaller
- players, and it also doesn't correspond to the true distributed
- nature of human-to-human trust. Furthermore, centralized global
- "trusted authorities" create a tempting target for attack, and a
- single-point-of-failure if an attack is successful.
-
- Depending on how you declare your trust relationships, OpenPGP is
- capable of providing the same hierarchical structure as X.509, but
- it is not limited to such a structure. The OpenPGP Web of Trust
- model is more flexible and more adaptable to represent real-world
- trust than X.509's rigid hierarchy.