Lets consider the following setup:
One has a decentralized network of servers. A single root certificate has been distributed to all servers which has been positively checked as authentic and untampered by each server owner using checksums distributed all over the internet. Each server connects to a centralized server (secured by the root certificate) over HTTPS and requests the signing of a certificate for itself, which is provided as long as it proves ownership of its domain. From that point on the server uses that certificate to identify itself and communicate over the network. Certificate pinning is used by all servers in the network and a new certificate is only accepted after the green light of the local server owner.
The problems this tries to solve:
- Secure the network against MITM attacks and eavesdropping, as my understanding is that the only real alternative consists of a manual exchange of keys between each server pair (or in WoT construction, which I deem similarly weak).
- The fact that requesting every server owner to pay for SSL certificates is unrealistic.
What would the main be weaknesses of such a setup in light of the problems it tries to solve? And what I am especially curious about is whether temporary full access to the centralized server infrastructure would theoretically allow long-term eavesdropping on and/or tamperering of communications between servers.