explanation for the cert chain and a TODO