The crypto is the middle part. "certificates of authenticity" have to cover the top and bottom ends. The sibling comment referred to the top. At the bottom, Verisign had a DUNS and payment dance that had more appearance than substance in determining authenticity.

Yeah, but someone has to first trust the signer.

I can start a CA tomorrow, doesn't mean anyone will put my root on their OS distro.