Sure, but CAs are useless unless they actually verify the identity of the people they're giving certificates to.<p>Verisign is the largest CA in the world and gave a certificate to a guy asking for a Microsoft certificate, without ever challenging him to prove his identity.<p>Seeing as a the signature in a digital certificate is legally binding in most countries, there's no reason for Verisign to not be prosecuted for signing something saying they verify or trust the identity of the random gent when it's quite clear they did no verification and have nothing to base their trust upon. Yet I doubt they'll ever be prosecuted for it.