Slight return on the Gateway PKI

Currently most Telcom operators and Electricity 
companies crank out paper-invoices in fully automated processes.  Only the 
actual delivery of by snail-mail involves humans.

 

Now, lets assume that these parties would turn to 
e-invoices and PKI, how would you expect these invoices to be signed?  
There are two variants:

  
Like the US Government (read: NIST) and the 
  Germans suggest: Companies hires additional employees that equipped 
  with smart cards, sign individual invoices.  Actually the Germans are 
  ahead of the US since they now have a technical facility that lets a 
  single user sign with a dozen smart cards.  This way they reduce the need 
  for additional staff with some 90%

  
The invoicing companies simply modify their 
  backend systems to automatically "sign" (instead of "print") on behalf of 
  the organization using a $500/Y Gateway PKI certificate, issued by a major 
  TTP.

 

I don't think that the commercial enterprises have 
any major problem of selecting method.  Since Gateway PKI also scales 
trust-wise at least 100 times better than enterprise-PKI, receivers will 
experience few problems with unknown trust anchors.

 

 

Anders Rundgren