That's the whole point of this discussion - they don't need to do anything like that and can be done transparently without any legislation. Just think of the sc

That's the whole point of this discussion - they don't need to do anything like that and can be done transparently without any legislation. Just think of the scenario where you bribe certain CA staff and get a sub CA of your own or something like that. Now you sign the exact same certificates as with upstream website and you're going to appear pretty much genuine.