Comment by thr0w3345

But that would only allow them to sign new certs, CA’s don’t get the private keys only the public part to sign... Or did I misunderstand you?