Certificates should have a maximum lifetime, and SPAKE2 identities should be SPKI not cert fingerprint about openscreenprotocol HOT 1 CLOSED

Changing the SPAKE2 input is a good idea, thank you @estark37. I believe we can replace the certificate fingerprint with the SPKI in SPAKE2 without too many changes to the existing protocol, which would give us the flexibility to extend certificates without forcing re-auth. I will put together a PR for that.

SPKI rotation is something I would have to think more about. If there's no connection for more than 2 lifetimes that would require a re-auth. That might be okay. It would also require procedures in the spec to require certificate regeneration and specifying valid signatures and chains. In this area, I would like to defer additional work until we have the other certificate issues sorted out, additional reviews and more implementation experience.

from openscreenprotocol.