That "Signing public keys to ensure their authenticity" is exactly what (any of the possibly as many as 600) public CA's that your browser and/or OS come pre-configured to "trust".
Who the hell are "Xramp Global CA"? "VRK Gov Root CA"? "UCA Root"? "Trusted Certificate Services"? They're all just random selections from the first page of trusted root certs in this OS X machine's list of System Root keys. Any of them could choose to "authenticate" a public key that claims to be my bank. Apart from the few pinned certificates in Chrome (I think mostly Google certs), I've got no more reason to believe any SSL connection I make is "authenticated" any more than Iranian Gmail users should have had when a DigiNotar root CA cert had signed those rouge Google SSL certs.
Comments
That "Signing public keys to ensure their authenticity" is exactly what (any of the possibly as many as 600) public CA's that your browser and/or OS come pre-configured to "trust".
Who the hell are "Xramp Global CA"? "VRK Gov Root CA"? "UCA Root"? "Trusted Certificate Services"? They're all just random selections from the first page of trusted root certs in this OS X machine's list of System Root keys. Any of them could choose to "authenticate" a public key that claims to be my bank. Apart from the few pinned certificates in Chrome (I think mostly Google certs), I've got no more reason to believe any SSL connection I make is "authenticated" any more than Iranian Gmail users should have had when a DigiNotar root CA cert had signed those rouge Google SSL certs.