CA's can issue or lose intermediate certificates that they shouldn't. These have been detected at least 3 times when these technically valid but never before se

CA's can issue or lose intermediate certificates that they shouldn't. These have been detected at least 3 times when these technically valid but never before seen certificate chains are used for google.com/yahoo.com/microsoft.com etc. http://googleonlinesecurity.blogspot.com.au/2013/01/enhancing-digital-certificate-security.html http://googleonlinesecurity.blogspot.com.au/2013/01/enhancin... https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion https://blog.torproject.org/blog/detecting-certificate-autho... http://www.chromium.org/Home/chromium-security/root-ca-policy http://www.chromium.org/Home/chromium-security/root-ca-polic...