Security considerations reated to trusting the TLS certificate

[elf-pavlik]

Capturing from https://github.com/solid/solid-oidc/pull/18/files#r781105146

@leifj: A general comment is that this is not strictly true. Since the AS fetches the WebID document of the user it relies on being able to trust the TLS certificate of the WebID URL. This implies that the AS shares a common trust-anchor with the OP. This assumption should at the very least be called out. There are deployment scenarios where trusting the "normal web trust anchors" (aka webpki) is not desirable.

@acoburn: It is true that the AS may share the same the same trust-anchor as the OP w.r.t the TLS certificate chain. But that is different than relying on a pre-existing (direct) trust relationship between the the AS and OP.

In other words, given a certificate chain X

AS --> trusts X cert chain OP --> trusts X cert chain

But this does not imply

AS --> trusts OP

@leifj: trust is in this case transitive. It is probably best to clarify this point in the text.