VMCs do not act like a typical TLS certificate. They do not encrypt traffic, use a private key or require a CSR to order. VMCs create a cryptographically verifiable and auditable connection between an identity, a logo and a domain. This ensures that the identified organization is operating on a domain that they own when sending emails to end-users.