this is becoming a mini series here.

also broken: certificate revocation. (maybe even the general idea of certificate pki.)