The current CA PKI system is pure madness. Everyone in the CA club can issue certificates for anything - and you are at their mercy for not revoking. And what&#x27;s worse, even if you pick a decent vendor, you can&#x27;t prevent shadier outfits from also issuing parallel certs. :(