Static specification (qrdate://)

[miunau]

Currently the static specification is a somewhat functional stub. We've been talking about using some sort of a certificate chain, but need more people to chime in on what the actual recommendation for the implementation would look like.

There's a couple of ways it should be possible to use:

• As a part of an organisation, you get provisioned a private key based on a certificate chain. You then use that private key in an application provided to you by your organisation (say, a mobile app).
• With your own private key, on your device, if you want to be considered an authority.
• Any others?

Any ideas and input are welcome!