[datadeft]

Yeah like how HTTPS CAs exist. There are some very nice three letter ones who can issue any certificate and your browser / OS happily accepts it.

[BenjiWiebe]

SSH doesn't have any CAs that it trusts out of the box. It's up to you to tell it which one to trust.