Summary

  • Signed ECH retries would give configuration-signing keys a distinct privacy role.
  • Operators should separate responsibility for recovery from responsibility for privacy-changing instructions.

A spare key is rarely just a convenience. In a proposal for Encrypted ClientHello, it would carry authority over how a connection recovers when its first attempt fails.

ECH hides the inner TLS greeting. DNS can supply its configuration. Today's ECH specification authenticates retries through the public-name certificate. Signed updates propose a different trust anchor: keys authorized by the initial configuration. A signed instruction can also disable ECH on the retry.

That makes signing authority an operational responsibility worth naming. A dashboard showing successful connections would not answer who authorized a privacy-changing instruction.

Availability and privacy need separate evidence, even when the same team operates both.

The individual draft is dated 6 July 2026, not an approved standard or a deployment announcement. Initial DNS delivery and origin authentication remain separate concerns. The useful question for operators is already clear: who owns the spare key, and who can explain its use?