It wouldn't insta-sign. It would go back to Verisign and they would do authorization against our client database. They called the client every time and did a nu

It wouldn't insta-sign. It would go back to Verisign and they would do authorization against our client database. They called the client every time and did a number of checks. We were just acting as an intermediary CA, which I think is a better setup than a bank acting as a root CA (as Wells Fargo et al are now) since we had Verisign looking over our shoulder seeing which certificates we signed and not being afraid to revoke So as I saw this situation, if they were setup as an intermediate CA, when the signing went up the chain it would have been noticed - rather than a cert being signed and instantly being verified by all browsers