PKI has one sentence that reads every certificate question right: trust chains up to a root, and the browser grades identity, not …

source