This form of "authentication" smells like DRM, especially as they're using it to limit power and they're using Digicert to sign devices. And if you're speaking X.509 or something on both sides I'm intensely curious to see how vulnerable the attack surface is.
The "authentication" that would actually help is to default to only allowing charging through ports (and allow charging without authentication - who cares where I get 65 W of power from? are there malicious electrons?), and show a little "new device" authentication screen with a Bluetooth-style pairing process when I connect something new. Then either burn an asymmetric key onto the device or generate a random symmetric key (and leave the CAs out of it), and on the host, bind the key to the current function of the device, as displayed on the pairing screen. If I clicked "Trust this keyboard," don't let it turn into a CD drive. If I clicked "Trust these headphones," don't let it turn into a keyboard. And so forth.
The "authentication" that would actually help is to default to only allowing charging through ports (and allow charging without authentication - who cares where I get 65 W of power from? are there malicious electrons?), and show a little "new device" authentication screen with a Bluetooth-style pairing process when I connect something new. Then either burn an asymmetric key onto the device or generate a random symmetric key (and leave the CAs out of it), and on the host, bind the key to the current function of the device, as displayed on the pairing screen. If I clicked "Trust this keyboard," don't let it turn into a CD drive. If I clicked "Trust these headphones," don't let it turn into a keyboard. And so forth.