conduct business this way and I want this amount of protection to prove that its me, then youre giving people choices."
Thus far, Iowa is undecided on the issue of outsourcing its PKI or running the system internally. According to Varn, the state will review RFP responses before making its choice. Either way its a business decision that carries a certain amount of risk.
"How do you know that two years from now a digital certificate, with full-blown trust, will not be something your bank offers you as part of its package of services?" said Varn. "We could end up paying for something that would become free to people later, just like we have seen with e-mail and other services."
Still, a growing number of state CIOs are betting that PKI technology holds the key to moving a vast number of government transactions to the Web.
"If you are going to reduce cost, youre going to have to do [electronic] transactions end to end, and theyre going to involve money and theyre going to have to be secure," said Kolodney. "It comes back to trust. How are you going to create a trustworthy relationship in an inherently untrustworthy environment? We think this is a way to do it."