The whole CA trust model is a complete mess. I suggest interested people to google for the work from moxie marlinspike (@moxie__), e.g., presentation from last BH (http://bit.ly/rbqMCq) and convergence (http://convergence.io/).