The point is that with a multi-level system, where the CA issuing the certificate is internal to the target, and where certificates are tracked over time, you c

The point is that with a multi-level system, where the CA issuing the certificate is internal to the target, and where certificates are tracked over time, you can detect what I call a divergence of timelines, i.e. a disruption of key possession.