Think of trust relationships as a forest of trees. Initial seeds of these trees are root certificates installed by browser vendors(Chrome: Google, Safari: Apple

Think of trust relationships as a forest of trees. Initial seeds of these trees are root certificates installed by browser vendors(Chrome: Google, Safari: Apple, Firefox: Mozilla, etc). Whenever you open an https site, if your browser checks whether to trust that https site. So, your browser trusts it if that site's public key is signed by the one of roots shipped/installed by the browser vendor. You can also add your own cert to the root certs list of any of the browser, then any site's key's signed by your cert is gonna be trusted. Next time, check whenever your browser says "Don't trust this site", then explore the key chain.