> You can not verify the entire chain, because it is possible that the domain you are looking up is infact unsigned. Then you conclude that it's okay that the

> You can not verify the entire chain, because it is possible that the domain you are looking up is infact unsigned. Then you conclude that it's okay that the domain is unsigned. Else - hard fail.