> What am I missing? The chain of trust for all the certificates in your example is established by trusting the rogue CA root certificate. The CA (or a bad act

> What am I missing? The chain of trust for all the certificates in your example is established by trusting the rogue CA root certificate. The CA (or a bad actor who misled the CA through real-world fraud) could be the “owner” of the key pair you’re trusting for the second signature.