For context: http://comments.gmane.org/gmane.comp.security.ssl.observatory/152 http://comments.gmane.org/gmane.comp.security.ssl.observator... Basically, a CA

For context: http://comments.gmane.org/gmane.comp.security.ssl.observatory/152 http://comments.gmane.org/gmane.comp.security.ssl.observator... Basically, a CA gave someone a cert that allows them to make and sign their own certs (for any domain) for the express purpose of allowing them to snoop on all ssl traffic on their network. They even imply that other CAs have and will do the same (even though they apparently changed their minds about allowing it). We need not worry about CAs being incompetent (see comodo and other issues) when they will intentionally engage in undermining the entire PKI system. Note that a corporate entity that really wanted to do this could just as easily make their own root cert and install it on all of the devices they control and accomplish the same goal without endangering the entire system.