Eidas is an annoyance for other reasons too IMHO - qualified trusted service providers are issuing authorities which are “qualified” by a national body. Their c

Eidas is an annoyance for other reasons too IMHO - qualified trusted service providers are issuing authorities which are “qualified” by a national body. Their certificates may be self-signed, but may be intermediates which are signed by a root that is also used for non-qualified CA purposes. Some authorities are granted an issuer-of-qualified-issuers status which allows them to issue both qualified and non-qualified sub-authorities. The data about all these issuing authorities is published in national lists which are signed by a national body, and these lists are then referenced in a Europe-wide list signed by a central authority, IIRC… So validation becomes a bit of an issue - to tell if a certificate is qualified you need not only to perform normal x509 path validation but also validation against a parallel trust chain which branches off from the x509 chain at some point and resolves via a national list and then a master list to the eidas root.