Still sounds like an improvement over the current PKI where any CA can sign any cert for any domain.<p>How many roots do you have in your browser&#x27;s trust store? How many of them would roll over and mis-issue certs if presented with a secret warrant in their country of residence? (All of them.)