ly used in e-mail and is widely deployed. Simple PKI (SPKI) came out of three independent efforts to overcome the growing popularity of PGP's Web of Trust and the complexities of X.509. With SPKI, users and sys- items are bound directly to keys, using a local trust model, somewhat like the Web of Trust, but with the addition of authorization. As the name suggests, Robot Certificate Authorities (Robot CAs) are automated pro- grams that validate certain aspects of a public key's validity and then sign it to attest that those aspects are indeed valid. The common aspects validated include the following: the use of the key is current, the holder of the destination e-mail address is aware that his or her key is published, and a secret key corresponding to the public key is in possession of the holder of the e-mail address. At this point, the most successful PKI implementations are in government. Digital Certificates Digital certificates, based on the ANSI X.509 specification, have become a de facto Internet standard for establishing a trusting relationship by using technology. X.509 comes from the X.500 specification on directory services, which serves as an electronic phonebook, allowing enabled applications to look up included entities. Each entity has an identifying record or certificate, and that certificate follows the ITU X.509 recommendation. Using digital certificates is a method for registering user identities with a third party, a CA (such as Entrust or VeriSign). A digital cer- tificate binds a user to an electronic signature that can be trusted like a written sig- nature and includes authentication, access rights, and verification information. CAs prepare, issue, and manage the digital certificates, and they keep a directory database of user information, verify its accuracy and completeness, and issue the electronic certificates based on that information. A CA signs a certificate, verifying the integrity of the information in it. By becoming their own digital CAs, service providers can package electronic se