Short answer: because the CA&#x2F;B forum requires this. See &quot;Baseline Requirements
for the Issuance and Management of Publicly-Trusted Certificates, v.1.1.7&quot; section 13.1.5 point 3.<p><a href="https:&#x2F;&#x2F;cabforum.org&#x2F;wp-content&#x2F;uploads&#x2F;BRv1.1.7.pdf" rel="nofollow">https:&#x2F;&#x2F;cabforum.org&#x2F;wp-content&#x2F;uploads&#x2F;BRv1.1.7.pdf</a><p>Long answer:<p>Certificate authorities provide assurance. In this instance, they received a request from someone asserting &quot;I am localhost.ttconfig.xyz, I have this public key, and I sign this entire statement using my private key&quot;. The certificate authorities validated that the requester did in fact control localhost.ttconfig.xyz, then they took the request above, added &quot;I am &lt;Comodo&#x2F;GeoTrust&#x2F;thawte&gt;, this certificate reflects the identity and intentions of &lt;subject&gt;, and I sign this entire statement using my private key&quot;.<p>Your browser trusts certificate authorities to make statements like these. This trust is not given blindly; it&#x27;s instead driven by complex procedural machinery. Browser vendors require certificate authorities to do specific things in order to earn and keep the browser&#x27;s trust. For example, see Mozilla&#x27;s CA policies:<p><a href="https:&#x2F;&#x2F;www.mozilla.org&#x2F;en-US&#x2F;about&#x2F;governance&#x2F;policies&#x2F;security-group&#x2F;certs&#x2F;policy&#x2F;inclusion&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.mozilla.org&#x2F;en-US&#x2F;about&#x2F;governance&#x2F;policies&#x2F;secu...</a><p>The certificate authorities have rules to follow, and they in turn require that their subscribers do certain things so the CA can comply with those rules. One of the requirements CAs make of their customers is that they protect their private key.<p>Why is this important? Well, remember that the CA made a statement that &quot;this certificate reflects the identity and intentions of &lt;subject&gt;&quot;. Losing your private key means anyone else can use that certificate, even if they are not you – which makes the CA&#x27;s statement a lie. CAs are built on trust, so they <i>must</i> revoke it.