Having a CAs private keys allows for crude impersonation, not wholesale interception as many believe. (State actors have gone this route in the past and been qu

Having a CAs private keys allows for crude impersonation, not wholesale interception as many believe. (State actors have gone this route in the past and been quickly discovered) Google.com generates a public/private key pair and has the public key signed by a CA. The signature only says "I verify this public key really belongs to google.com," it does not become part of the actual cryptographic transaction.