[pyre]

Also...

  > provided Apple's own CA hasn't been compromised

We've been seeing this happen a lot lately, so that's a big assumption.