*Optional* lookup of certificate stores
Since TOFU is clearly a very weak way to ensure the authenticity of the remote server, it could be cool to lookup of of the certificate stores and warn the user if there is a discrepancy.
Here is one such trust store, whose stored certs are already in the Agunua format https://tildegit.org/nervuri/trust-stores
Of course, it MUST not be by default since certificate stores are not an "official" Gemini solution and since they raise other issues.
Long term: creating our own certificate store with two or three requests through Tor from the database of Lupa? Using certificates gathered from Lupa is not perfect since it is only one vantage point. Code already exists https://tildegit.org/nervuri/trust-store-generators See also https://lists.orbitalfox.eu/archives/gemini/2021/006623.html for a simple torsocks+openssl solution.
See also #35.