[jfrunyon]

That's easy, since you have control over trusted CAs. And also, not true; it could be done in the TLS library.