By design, the CIA cross-signing the cert wouldn't constitute a vulnerability. With that in mind, why would they sign it in the first place?
>Also, what is it with Microsoft that it keeps "silently" adding root certs to its operating system or other services? Does it really not understand that's highly suspicious? Why not publicly announce it?
While I do agree that Microsoft should make some kind of public statement (hopefully still forthcoming), maybe they kept it under wraps until now because Amazon didn't want their new service being revealed before they rolled it out?
I'm not trying to defend Microsoft, or Amazon, or the CIA for that matter, but this article's fairly biased. Hinting at "Amazon is reported to have some very close ties to spy agencies" without expanding on that, seems almost like a clickbait tactic.
Also, what is it with Microsoft that it keeps "silently" adding root certs to its operating system or other services? Does it really not understand that's highly suspicious? Why not publicly announce it?
This isn't the first time it has done this. It makes matters worse in light of all the "silent" upgrades they are doing to Windows 10, many of them about bypassing tools that are stopping its invasive privacy "features".