> because of how they're created (i.e. you generate the keyset yourself locally, they sign the public part), it should be secure. Note that if the CA has the a

> because of how they're created (i.e. you generate the keyset yourself locally, they sign the public part), it should be secure. Note that if the CA has the authority to sign certificates, they don't need your private key. They can just locally create a CSR for your domain, sign it, and have their own equivalently valid certificate for your domain. Moreover, in the absence of HPKP, any CA can do this for any domain.