Rather than establish our own authority we could try to leverage an
existing one, as Java does. com.microsoft.foo.bar is reserved for the
owner of the microsoft.com DNS name. This may not be the most
suitable level of entity for an authorization system. The example
above could either refer to the foo.bar module of microsoft.com, or
the bar module of foo.microsoft.com, which for Microsoft Corporation
may not be such a problem, but for other hosts that conflict may be
unacceptable. The naming is also not actually enforced by any of the
Java tools - nothing is stopping me from distributing my own
com.microsoft modules.