That's part of why the Root CA certs are A) Long lived and B) why having an untrustworthy root CA is the most calamitous outcome possible. Because the algor

That's part of why the Root CA certs are A) Long lived and B) why having an untrustworthy root CA is the most calamitous outcome possible. Because the algorithm that yields the answer to your question really only answers the question "Does the cert I was handed cryptographically validate back to a trusted root?" If you can pwn the routing/DNS sufficiently around an AS, you could MITM all the authoritative sources, and with something like TrustCor, willing to issue duplicitous root certs and cert chains, while being trusted by major OS and software package maintainers, you can, in theory, pull the old switcheroo, and the software will still tell you "seems legit, hoss". This is part of why the Internet is architected as a "collective network of networks composed of Trusted Agents". At the end of the day, you're depending on every middle box routing your packet to do the job to get it where it needs to go. The type of Trust you're looking for is incompatible with technologically facilitated networking in a sense. The network cannot prove the trustworthyness of the network. Trust has to start outside it. The trust we've rooted from is from the integrity of the institutions we've established. Something that has been eroded more and more over time as the Internet infrastructure has slowly been civically infiltrated to shape it into a surveillance tool by governments. If you're feeling heartburn over this, the problem isn't the Internet per se. It's your Government, and your institutions, and for places that like to think they are populace driven, the people around you.