CAs do not ever see their client's encryption keys. If a CA was compromised someone could only create authentication keys for websites. This type of an attack c

CAs do not ever see their client's encryption keys. If a CA was compromised someone could only create authentication keys for websites. This type of an attack could work on a single person. It would not work for a large group of people because this type of attack is very easy to detect (by someone who is looking for it) and very traceable.