Indeed they are cross-signed with a Starfield root, so I wonder, what would be the point of adding them natively? Are there any benefits to that?

Eventually, once the roots are trusted natively in enough systems, dropping the cross-signed root, making handshakes smaller and path-building simpler. Also some of their roots are stronger than the cross-signer, so when/if the cross-signer becomes too weak and gets dropped, the better Amazon roots will stay.

And I guess being a first class citizen of the CA space, which is good because it brings audits, participation and accountability.

>And I guess being a first class citizen of the CA space, which is good because it brings audits, participation and accountability.

Just to clarify on your last point. If Amazon wants to issue certificates it has to conform to industry regulations and undergo audits regardless of if its using another companies' roots.

Is it cross-signed by the CIA, too, though? (one of Amazon's largest customers)

Also, what is it with Microsoft that it keeps "silently" adding root certs to its operating system or other services? Does it really not understand that's highly suspicious? Why not publicly announce it?

This isn't the first time it has done this. It makes matters worse in light of all the "silent" upgrades they are doing to Windows 10, many of them about bypassing tools that are stopping its invasive privacy "features".

>Is it cross-signed by the CIA, too, though?

By design, the CIA cross-signing the cert wouldn't constitute a vulnerability. With that in mind, why would they sign it in the first place?

>Also, what is it with Microsoft that it keeps "silently" adding root certs to its operating system or other services? Does it really not understand that's highly suspicious? Why not publicly announce it?

While I do agree that Microsoft should make some kind of public statement (hopefully still forthcoming), maybe they kept it under wraps until now because Amazon didn't want their new service being revealed before they rolled it out?

I'm not trying to defend Microsoft, or Amazon, or the CIA for that matter, but this article's fairly biased. Hinting at "Amazon is reported to have some very close ties to spy agencies" without expanding on that, seems almost like a clickbait tactic.