So I was experimenting and if you can get signed certs from let’s-encrypt and dns records from cloud-flare, then you could store your public signed certificate as a set of split txt entries which anyone could verify with a set of trusted root certificates. You can then use the private key to sign an encryption key (stored as another txt record) along with the encrypted message (also another txt record).

This would allow you to sign, store, and send short messages (in a single direction) with confidentiality, integrity, and authenticity all through a plain text protocol (as long as the root certs exist)!

Verification Chain:

• The message data is hashed into -> The encryption key
• The encryption key is signed with -> The private key
• The private signature is decrypted with -> The public key
• The public key is embedded into -> The signed certificate
• The signed certificate is verified with -> The root certificates
• The end verify -> The root certificates + The domain name + The expiry time

# ./dns_fun.sh fossjon.com d

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:b3:64:ec:80:70:47:42:2a:8a:ef:b4:11:60:03:9d:23:78
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Let's Encrypt, CN=R3
        Validity
            Not Before: Oct  9 18:35:11 2021 GMT
            Not After : Jan  7 18:35:10 2022 GMT
        Subject: CN=*.fossjon.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c8:1c:f6:86:b7:b5:45:63:68:7b:e4:34:10:6e:
                    0c:51:da:73:5b:65:d4:f7:fd:c8:c7:2e:d8:8b:01:
                    2d:c5:67:a4:0e:7a:b6:57:bf:fe:2a:c9:52:4d:38:
                    51:56:a6:08:bb:5a:8f:85:32:88:c0:3c:9b:3e:ad:
                    f9:1a:aa:21:fb:b6:2f:d1:7c:bc:c1:6e:ae:d8:b4:
                    c9:87:a5:69:a4:c5:f9:1d:3a:1f:49:68:94:75:b9:
                    ab:f6:12:9f:56:4c:7f:26:f1:6e:85:9e:1e:66:be:
                    74:e0:01:91:6d:59:cb:0d:34:01:10:5c:b9:43:44:
                    52:07:6a:ca:3f:83:1e:41:6c:51:5a:a6:fa:20:8f:
                    33:40:76:90:ab:4d:04:6f:33:70:f0:09:c7:38:25:
                    26:15:70:d6:f9:f4:e6:b6:71:11:e0:7a:c6:04:86:
                    30:c9:56:f0:14:6e:9e:66:60:b3:7d:2b:42:a4:b9:
                    fb:6d:73:4f:26:2e:17:aa:a8:64:72:e2:f5:a8:b1:
                    17:8d:f4:db:a8:10:fc:70:ff:1b:cc:78:6f:04:84:
                    e0:fc:1d:15:72:de:41:bd:14:c5:26:72:3e:56:2a:
                    aa:1d:9f:1a:3c:17:40:91:21:7e:2a:b4:8a:c2:ab:
                    79:0f:dd:21:13:a1:2e:da:6a:a3:92:49:e7:f1:58:
                    36:bf
                Exponent: 65537 (0x10001)

Secret_key_123-77cf362ab2442e3fa3062d06adb571f0ea92647f0ba137300a272767d6ea0834

this is just a test of the emergency broadcast system, this is not the real thing!

#!/bin/bash

d="$1" ; z="$2" ; m="$3" ; k="$4"
echo

if [ "$z" == "e" ] ; then
  h=$(echo "$m" | openssl dgst -sha256 -r | awk '{ print $1 }' | tr -d '\t\r\n')
  t="${k}-${h}"

  e=$(echo "$m" | openssl enc -aes-256-cbc -e -k "$t" -S 00 | base64 -b 255)
  echo "$e" ; echo

  s=$(echo -n "$t" | openssl rsautl -sign -inkey privkey.pem | base64 -b 255)
  echo "$s" ; echo

  p=$(cat crt.pem | grep -iv '^---' | base64 -d | base64 -b 255)
  echo "$p" ; echo
fi

if [ "$z" == "d" ] ; then
  c=$(dig "z.pubcrt.$d" txt +short | tr -d ' "\n' | base64 -d | base64 -b 64)
  ( echo '-----BEGIN CERTIFICATE-----' ; echo "$c" ; echo '-----END CERTIFICATE-----' ) > /tmp/crt.pem

  t=$(openssl x509 -text -noout -in /tmp/crt.pem | grep -i 'exponent' -B 64)
  echo "$t" ; echo

  v=$(dig "z.pubkey.$d" txt +short | tr -d ' "\n' | base64 -d | openssl rsautl -verify -certin -inkey /tmp/crt.pem)
  echo "$v" ; echo

  o=$(dig "z.pubmsg.$d" txt +short | tr -d ' "\n' | base64 -d | openssl enc -aes-256-cbc -d -k "$v")
  echo "$o" ; echo
fi