Carl Ellison
Cryptographer who argued that a certificate should say what a key may do, not who owns it, and wrote the standard to prove it.
Ellison was lead author of SPKI, the Simple Public Key Infrastructure, published as RFCs 2692 and 2693 in 1999. Co-authors included Ron Rivest, Butler Lampson and Tatu Ylönen. The premise was that globally unique names are a fiction: nobody knows which "John Smith" an X.509 certificate means. SPKI instead binds permissions directly to keys and lets them be delegated onward.
In 2000 he and Bruce Schneier wrote Ten Risks of PKI, which asked, point by point, whom the certificate authority actually trusts and why the user should. SPKI never caught on, but its ideas live on in capability systems and delegation tokens such as Macaroons. Ellison later worked at Intel and Microsoft.