These third-party CAs also want to issue certificates for corporate use. VeriSign would like to act as these organizations' CA but is will ing to sell them its CA technology and approve the companies as CAs if they meet their exacting standards of what a CA should be. It's obvious, then, that a hierarchy of CAs will form. If all companies used VeriSign as their CA for the outside world, the whole process would be easy. A super authority is important, according to conventional wisdom, because there are questions as to whether the third-party CAs would recognize one another's certificates and how effectively the process would be if they did.
Fragmentation is already apparent.
For example, VeriSign will issue digital certificates to Visa International Inc., which will in turn issue them to merchant s and consumers for use as electronic credit cards. American Express Co. Beyond the cross-referencing issue, there is the central matter of trust. Everybody wants to issue certificates, so a key concern will be whether you can trust the issuer to act responsibly. On the other hand, an Internet merchant may issue you one to purchase goods and services with your credit card. Given the amount of fraud on the Internet, that is a more dicey proposition.