Barge: "human elements of power and trust"
While I agree with your TCG political spin on the above quote, I am still concerned about it in terms of KTM ES AD placing too much trust in System Administrators as the sole recovery keys holder, which gives him/her too much power. They would have the means to crush organizations of all sizes that employee them. Not unlike many of them could before tpms. Admins and CIO's are obviously careless with our confidential data at financial and other industries as we are sadly learning in the press daily.
Outside of having internal controls to separate this resposibility across more employees or departments than IT/MIS, I do agree that Wave's TAN could be an objective holder of the keys.
So, if Wave TAN alone or TAN IP licensed to 3rd parties becomes the standard for holder of the keys Wave needs to employ hackers to try find holes and get keys from the TAN(s) because Wave would have a bullseye on them like MSFT and Cisco today. Wave must diversify TAN servers and mirror them across global locations, and get some huge liability insurance. In addition, WAVX shareholders better keep eyes open for a TAN or KTM ES AD key security breach as it would hammer the share price if Wave did not respond appropriately.
