&gt;Is it cross-signed by the CIA, too, though?<p>By design, the CIA cross-signing the cert wouldn&#x27;t constitute a vulnerability. With that in mind, why would they sign it in the first place?<p>&gt;Also, what is it with Microsoft that it keeps &quot;silently&quot; adding root certs to its operating system or other services? Does it really not understand that&#x27;s highly suspicious? Why not publicly announce it?<p>While I do agree that Microsoft should make some kind of public statement (hopefully still forthcoming), maybe they kept it under wraps until now because Amazon didn&#x27;t want their new service being revealed before they rolled it out?<p>I&#x27;m not trying to defend Microsoft, or Amazon, or the CIA for that matter, but this article&#x27;s fairly biased. Hinting at &quot;Amazon is reported to have some very close ties to spy agencies&quot; without expanding on that, seems almost like a clickbait tactic.