So this solves a problem with intermediate certificates expiring, but the scope is pretty narrow.<p>There are two types of key here, a "provider public key" and a "resolver public key". The provider key signs the resolver key which signs the requests. This is a system to keep the resolver key from having problems. If you're a website, this is basically irrelevant, because you do the equivalent of having the provider key sign requests. You have no intermediate to worry about at all.<p>But what if you're Mozilla, and you <i>do</i> have a problem with intermediates expiring?<p>Well if you put this directly into place everything would get much worse. Extensions would expire after a few hours.<p>You would have to change your validation logic, to accept signatures that were made <i>while</i> the intermediate was valid, even though the intermediate has expired. (You could set a 12 month limit to make this no less secure than the old system.)<p>But... if you did this validation change, that would have prevented the extension problem in the first place, all by itself!<p>This system of short-lived intermediates is <i>nice</i>, but it's way more important in its original home. For extension signing it would almost only be a convenience.