This is why self-signed certificates are more secure than CA-signed certificates. When you expand the trust model to include three parties rather than two, it g

This is why self-signed certificates are more secure than CA-signed certificates. When you expand the trust model to include three parties rather than two, it gets much more complex and vulnerable. If I see a self-signed certificate from CitiBank, I know that the counterparty claims to be CitiBank. That's all I know. When I receive a Verisign-signed certificate from CitiBank, I know a party claiming to be Verisign claims that the counterparty is CitiBank. That doesn't realistically help me much.