OV & EV also don’t prove that you’re the expected business with a given name. E.g. the incident where Ian Carroll registered a local business named “Stripe, Inc.” and got an EV cert for it. Which was entirely valid, despite being the name of a payment processor. Business names aren’t globally unique.

Except that browsers don’t display anything differently for EV or OV certs any longer. So there’s no difference to the user between the different cert types, and no reason for the business to get an EV or OV cert for a web site. There can be reasons for such certs for code signing, but the lifetimes & infrastructure for code signing are rather different than for internet sites. Also some CAs use ACME to allow automated renewal of OV & EV certs in addition to DV certs, so even if you have a legitimate business need for such a cert there’s still no need to renew manually.

Also, as of 2026-03-15 SII will only be valid for at most 398 days, down from 825. Max TLS cert lifetime will drop from 398 days to 200 days. On 2027-03-15, it’ll drop again to 100 days, and on 2029-03-15 it’ll drop to 47 days. Even for EV & OV certs. 47 days.

The only network you’re likely to use that actually follows the OSI model is the CAN bus inside a car. And that’s starting to get replaced by DoIP, which uses the IP model (link layer, internet layer, transport layer, application layer, note the lack of session & presentation layers and combination of the physical & data-link layers into the link layer).

The “AI safety” field is about two things: marketing AIs as so powerful that they’re risky to use but riskier to get left behind by competitors using, and keeping AIs from doing so much brand damage that stock price suffers. This story is about marketing an AI as powerful.