The plan is to have a situation in which no third parties have to be trusted unless you explicitly indicate so. For example CA's are only used when the contact explicitly added the CA as a trusted party (there will be no such thing as root CA's or trusted CA's signing other CA's).
Methods I collected so far:
- The above CA example.
- Using a web-of-trust.
- Sending a one time password to an un-authenticated public key, requiring this password to be sent back to you through another medium to prove it's you. Such as an SMS from a number that was known in advance or face-to-face. Since only the private key holder would be able to know this password it proves they own it.
Are there any other ways to authenticate certificate owners when you are not bound by standards but cannot distribute hardware in advance?
To clarify: It's about verifying the private key holder is really the person you believe should be the holder. So in other words it's about authenticating the identity of the owner of the certificate. So like: "Hey firstname.lastname@example.org! Are you really the Frank I know from class?"