 This can function as a "4 corner model of trust" adding another check to determine if a root certificate has been compromised.Rules governing the Federal Bridge policy for revoking compromised certificates are available at www.idmanagement.gov.The contrast of this browser bundled approach is that in X.500 or LDAP the attribute "caCertificate" can be "bound" to a directory entry and checked in addition to the default pre-loaded bundle of certificates of which end users typically have never noticed unless an SSL warning message has appeared.