[elmerfud]

https://usgovpki.apps.deas.ecs.mil/dod/cas-all-simple/index....

I don't know if their change was intentional but the DoD does publish their CAs for use. I also have to say that if you are blindly trusting the CAs that your browser includes to determine the legitimacy, authenticity or security of your data going to the target of your intention, you are in for a very rude awakening when you learn how they work and how most of them issue certificates.

The way most certificates are signed nowadays is only as strong as the DNS hijacking protection they have. Preloaded CAs make for an ease of browsing experience but protection they actually provide is only in the encrypted transit and not much beyond that.

[thom_nic]

This is fair, but I would venture to guess 99% of people including software developers and even most IT professionals completely rely on the vendor pre-installed root CAs.