Sam pointed out that by integrating http://point-at-infinity.org/ssss/, Certified could almost prevent anyone ever knowing the root CA's private key.