Matt Blaze on SSL certificates

A decade ago, I observed that commercial certificate authorities protect you from anyone from whom they are unwilling to take money. That turns out to be wrong; they don't even do that much.

-- http://www.crypto.com/blog/spycerts/