[MattJ100]

Of these, (1) and (2) are already implemented in XMPP.

(1) just isn't that widely deployed due to low DNSSEC adoption and setup complexity, but there is a push to get server operators to use it if they can.

(2) is defined in RFC 7711: https://www.rfc-editor.org/rfc/rfc7711 however it has more latency and complexity compared to just using a valid certificate directly in the XMPP connection's TLS handshake. Its main use is for XMPP hosting providers that don't have access to a domain's HTTPS.

[thayne]

2 isn't quite the same as my idea, it uses a list of fingerprints for valid certs instead of a CA itself, but it is roughly equivalent.