eMudhra’s announcement that it is leaving the global SSL/TLS certificate business is a page of corporate prose, and by midweek it was sitting at the top of Hacker News with 830 points and 581 comments. The Chennai certificate authority is getting out of the padlock trade.

The thread has already decided what it means: the browser cartel squeezed out another independent, the root programs have become an unaccountable priesthood, and the whole public-key infrastructure is a protection racket with a style guide. Some of that is true. None of it is why eMudhra left.

A Retreat, Not a Martyrdom

Read the announcement as capital allocation rather than as a manifesto and it becomes almost dull. Global TLS is a business with a fixed cost structure — annual WebTrust audits, continuous compliance with the CA/Browser Forum’s baseline requirements, incident-response obligations, and root program reviews conducted by Mozilla, Google, Apple and Microsoft — sitting on top of a sale price that has been converging on zero since Let’s Encrypt began handing out domain-validated certificates for free. Cloud providers throw certificates in with the compute. The marginal certificate is worth roughly what the marginal email account is worth.

The exit is what any company does when a division’s return on capital goes negative. What’s notable is that eMudhra said so out loud, in a document addressed to customers, instead of burying it in an earnings footnote. You don’t do that unless you’ve concluded the reputational cost of a visible retreat is lower than the cost of staying.

The Compliance Layer Isn’t the Parasite

The standard critique, and the one animating most of those 581 comments, is that audits and root programs are rent-seeking overhead bolted onto mathematics. But the mathematics was never the product. X.509 has been a solved problem for decades; what a bank’s procurement department buys is not encryption but a third party’s signature on a document attesting that somebody checked. The audit is the product. The certificate is the receipt.

Which means the compliance layer isn’t a gate in front of the market. It is the market. And that is exactly why the market can’t support many participants: everybody can pass the audit, so nobody can charge much for passing it. A commodity input, freely available, with a compliance tax on top. That isn’t a cartel. It’s a utility with a paperwork problem, and the paperwork is the only part with a price.

The people who ought to update their priors are the ones who think the fix is a more “open” root program — as though the binding constraint were the number of applicants rather than the value of the good being sold.

What eMudhra Sells at Home

eMudhra is not leaving the trust business. It is leaving the part where the customer is a sysadmin with a corporate card and returning to the part where the customer is a statute.

In India, the company’s core franchise is licensed trust: digital signature certificates and eSign services issued under the IT Act framework and supervised by the Controller of Certifying Authorities. Those signatures carry legal force in a way no TLS certificate ever will — they stand in for a wet signature on a government form. The moat isn’t cryptographic. It’s a license, and it’s the sort of license that does not get pulled over a misconfigured OCSP responder.

A reseller working the booth next to eMudhra’s at a Mumbai fintech expo once described the split to me without any apparent irony: the global certificates were the business you showed investors, and the domestic ones were the business that paid for the office.

So the crowd cheering the retreat is cheering the collapse of the competitive model while ignoring the thriving licensed one. If you want to see what certificate authority looks like once four browser root programs stop standing between the market and the state, it isn’t a libertarian paradise. It’s a queue outside a regulator’s office in Delhi.

A Private Regulator Beats a Public One

Here is the part that should make the right uncomfortable. Chrome and Mozilla deciding who may issue certificates is, on its face, a private body exercising public power with no due process and no meaningful appeal. That ought to bother conservatives, and it does — right up until they inspect the alternative. The alternative is a statutory trust regime: the state licenses the issuers, the state sets the price of a signature, and the state decides whose identity counts. India already runs one of those. It functions. It is also considerably less free than the arrangement the comment thread spent the week denouncing.

Root programs are ugly because they are doing a job with no clean institutional home. Somebody has to decide which authorities are trustworthy, and the candidates are four browser vendors with commercial interests, a standards committee in Brussels, or nobody at all. Nobody is how you get the Verisign era back — a market where a certificate costs as much as a used car and arrives with a fax confirmation.

The antitrust enthusiasts now warming up to take a swing at Chrome’s root store should think hard about who inherits it. It won’t be a flourishing market of independent authorities. It will be a lobbying campaign to write the next set of root store rules, and the winner will be whoever retains the best lawyers in Brussels.

eMudhra looked at both businesses and chose the one where the law does the gatekeeping. That isn’t a defeat for the open web. It’s a compliment to it, from someone who has actually read the balance sheet.