One should be allowed to be a CA for everything under one's domain, and nothing else. The idea that every CA must necessarily be trusted for every name in the

One should be allowed to be a CA for everything under one's domain, and nothing else. The idea that every CA must necessarily be trusted for every name in the world is … insane.