Comment by cpburns2009

It's a strange liability that every trusted CA is authorized to sign certificates for every possible domain, even ones it has no right signing. It would make more sense for them to be limited to a set of TLD/ccTLD.