Address clients that are offline for long periods of time

[jyasskin]

People with expensive data plans may run out of data early in a month, and not come back online until the next month. The 7-day validity limit in https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html#signature-validity is good or even too long while online, but not enough while offline. We need to figure out if we can give clients permission to use expired signatures under certain circumstances, and if so, how to specify that.

[sleevi]

Is the framing correct? It presumes it’s desirable or even good for clients to use expired signatures, and it’s just a matter of figuring out “how.” It seems the bigger question is whether that is a valid use case, given the security risks - with a perfectly acceptable answer being “No, this is not a valid use case.”

[jyasskin]

@sleevi Yeah, good point. How's the new wording?

[sleevi]

👌❤️