actually, only the outermost one should be signed by any trust anchor, the rest should be a linear chain