On the risk of being snarky: Personally, I feel pretty confident that the number of people that know how any of this [certificates] works can be

On the risk of being snarky: Personally, I feel pretty confident that the number of people that know how any of this [certificates] works can be narrowed down to the people that work in these companies in the list. At least not too far off. If you believe that this is true, then you should probably start reading a bit. I would suggest you start at the Wikipedia article for a company called Diginotar [1]. And try to understand the relevance of certificate management. In fact, checking the default Firefox CAs [2], the very first entry is TurkTrust, a CA were some people have probably very good reasons to manage that certificate [3]. [1]https://en.wikipedia.org/wiki/Diginotar https://en.wikipedia.org/wiki/Diginotar [2]https://wiki.mozilla.org/CA:Overview https://wiki.mozilla.org/CA:Overview actual list is apparently https://docs.google.com/spreadsheet/pub?key=0Ah-tHXMAwqU3dGx0cGFObG9QM192NFM4UWNBMlBaekE&single=true&gid=1&output=html https://docs.google.com/spreadsheet/pub?key=0Ah-tHXMAwqU3dGx... [3]http://arstechnica.com/security/2013/01/turkish-government-agency-spoofed-google-certificate-accidentally/ http://arstechnica.com/security/2013/01/turkish-government-a...