Entrust sold 35,000 server certificates in the last financial year. We assume people bought them because they are going to use them. Of course, CAs would sign a contract promising not to do so, but that does not remove the capability. Parris argued the pros and cons of both approaches. The downside is that the system may not be able to communicate with outside agencies because the certificate standard may be implemented differently.
Certificates are a long way from being the Holy Grail of computer security.
They must be used properly to achieve any kind of acceptable result. The fact is that there are so many parties involved in the process that ensuring it all runs smoothly is a nightmare. A key has a cryptographic lifetime, as well as a theft lifetime, built into the vulnerability estimate of the subsystem storing it. From these, it is possible to compute the probability of the loss of a key as a function of time and usage. Whether or not a vendor does this computation, and even supports key revocation, is debatable.