nPKI
requires complete trust in one root authority.
qNo
globally defined single trusted root.
nPractically impossible to setup one (at least in the
foreseeable future)
qWhy
should I trust X completely?
nProblem
of certificate revocation
nIt may not
always be possible to validate a certificate chain all the way to the root (assuming one) because of network reachability issues