2.5 years ago, I migrated all my services hosted on a cloud provider to a homeserver.
This homeserver is also my workstation/gaming/dev/everything. I use QubesOS (an operating system based on the Xen hypervisor), and wrote some document about it: https://neowutran.ovh/qubes/articles/homeserver.pdf
Basically, I am hosting:
- DNS
- Matrix
- Jitsi
- Mumble
- Peertube
- Screego
- Nextcloud
- Searxng
- Tor
- Wireguard VPN
- Copy of wikipedia
- Personal website And others.
And for TLS, to have better security, and to avoid relying on third party company/providers, I am using DANE.
https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities
https://sr.ht/~yukikoo/dane_without_root/
https://github.com/buffrr/letsdane
The “dane_without_root” is one of my projects and I am welcoming review / feedback on it
( I also posted about it on the QubesOS forum: https://forum.qubes-os.org/t/highlighting-neowutrans-technical-doc-about-qubes )
If you’re just pushing for WebPKI without “thinking too hard” about perpretrating a security system with a large number of failure points, then you’re following that windows method.
SSL/TLS have very specific benefits. None of which matter that much for reading random articles on the web. So I don’t see the problem with this website doing their own thing to bring attention to the potential issues of the current system.