EU Policies Meet Global Practices: The Discourse on Qualified Website Authentication Certificates

The revision of the European electronic Identification and Trust Services (eIDAS) Regulation (EU) 910/2014 has sparked considerable debate, particularly concerning the mandatory recognition and display of Qualified Website Authentication Certificates (QWACs) by browsers under Article 45. Open letters from security researchers and browser vendors, among others, have highlighted potentially harmful implications for trust, sovereignty, and interoperability, while other stakeholders have labeled the corresponding arguments as disinformation and emphasized anticipated benefits. This study scrutinizes the origins, governance context, and arguments surrounding the "QWAC controversy'' using a qualitative mixed-methods approach. Our data collection relies on a multivocal literature review that encompasses academic publications, position papers, and social media posts, as well as 15 semi-structured stakeholder interviews with supporters and critics of the revised Article 45. We map 20 core arguments that emerged from a coding of our data into 1247 Toulmin components into three themes: Security & Trust, Governance & Sovereignty, and Compliance & Interoperability. The analysis reveals divergent viewpoints, advocacy strategies, and the dissemination of conflicting information in a situation of uncertainty. Indeed, our evaluation demonstrates that the strength of many exchanged arguments still hinges on future implementation choices. This research clarifies socio-technical trade-offs in EU digital trust policy colliding with the established WebPKI and offers evidence-informed considerations for balancing public and private interests in the future discourse.