A discussion around the article argues that unauthenticated TLS cannot be called secure and that serious attackers are mostly man-in-the-middle attackers who trick victims into diverting their own traffic, such as via DNS injection. It also debates private-key checks, noting that the eMudhra incident—where key entropy was reduced to the final byte—shows weak keys can be found with trivial brute force while the CA ecosystem largely relies on trust rather than detecting such incompetence.