Comment by teddyh

See also Everything you Never Wanted to Know about PKI but were Forced to Find Out, by Peter Gutmann:

http://www.cs.auckland.ac.nz/~pgut001/pubs/pkitutorial.pdf