So one of the key benefits of this system is that two (or more) distributed CA's issue the certificate so if one is compromised (or the government demands access) the server (and client) are still safe?