Every certificate should root in self-attestation, and all PKI sigs should be attached/revoked after the fact. But that GPG-like schema is probably never gonna

Every certificate should root in self-attestation, and all PKI sigs should be attached/revoked after the fact. But that GPG-like schema is probably never gonna happen, because money.