A public key infrastructure system comprising: a participant certificate authority that issues an end entity certificate, wherein the end entity certificate is configured to be relied upon in at least two different trust domains that have different rules governing liability, recourse, and dispute resolution, there being no trust bridge certificate authority between the trust domains; a root certificate authority configured to issue to the participant certificate authority an issuer certificate, wherein the issuer certificate contains a public key of the participant certificate authority in a subject name field; the participant certificate authority configured to issue the end entity certificate, wherein the end entity certificate names a participant corresponding to the participant certificate authority in an issuer name field and a subscriber in a subject name field; the participant certificate authority further configured to issue a self-signed issuer certificate to itself, wherein the self-signed issuer certificate names the participant in an issuer name field and in a subject name field and contains the same public key that is contained in the issuer certificate issued by the root certificate authority; wherein the end entity certificate can be verified by the public key in the issuer certificate issued by the root certificate authority and in the self-signed issuer certificate issued by the participant's certificate authority; wherein just one trust domain is bound to the end entity certificate at any given moment; and wherein the end entity certificate is configured such that when relied upon by a relying party, the trust domain that is to be bound to the end entity certificate is elected by the relying party at the time of reliance based upon a specific certificate validation methodology selected by the relying party. a participant certificate authority that issues an end entity certificate, wherein the end entity certificate is configured to be relied upon in at least two different trust domains that have different rules governing liability, recourse, and dispute resolution, there being no trust bridge certificate authority between the trust domains; a root certificate authority configured to issue to the participant certificate authority an issuer certificate, wherein the issuer certificate contains a public key of the participant certificate authority in a subject name field; the participant certificate authority configured to issue the end entity certificate, wherein the end entity certificate names a participant corresponding to the participant certificate authority in an issuer name field and a subscriber in a subject name field; the participant certificate authority further configured to issue a self-signed issuer certificate to itself, wherein the self-signed issuer certificate names the participant in an issuer name field and in a subject name field and contains the same public key that is contained in the issuer certificate issued by the root certificate authority; wherein the end entity certificate can be verified by the public key in the issuer certificate issued by the root certificate authority and in the self-signed issuer certificate issued by the participant's certificate authority; wherein just one trust domain is bound to the end entity certificate at any given moment; and wherein the end entity certificate is configured such that when relied upon by a relying party, the trust domain that is to be bound to the end entity certificate is elected by the relying party at the time of reliance based upon a specific certificate validation methodology selected by the relying party. <EOS>