I'm a little familiar with CAC cards from years ago. I don't believe they were using them to sign emails at that time. Thats different than the signing process I was familiar with. That would work.

The DoD root CAs are pretty damn secure. They're offline in physical vaults on military installations. Compromising one of those is a far cry more difficult than some town of 400's local PD e-mail server.

Granted, you only need to compromise a RAPIDs office to issue yourself a CAC, but that is still offline and on military installations (though often much less secure reserve/guard installations).

Wouldn't the cert need to be specific to the individual for proper identification? So getting one for yourself might not provide the sufficient privilege.

The cert would verify that a specific individual signed the email, with someone having previously verified issuing the credential to the right person (this sort of thing is usually issued as a smart card ID, so it's used for several things, and it's unlikely people lose it without reporting it lost and getting it revoked).

They specifically mentioned issuing themself one, not stealing one.

Yeah, issuing themself one through RAPIDS. You need to authenticate against RAPIDS to issue one. So you're looking at stealing a credential, and hoping you can get it done before it's noticed it's gone and revoked, and hoping that they don't go ahead and look at logins between when it was last seen and when it was revoked in order to see if there's any weirdness, at which point your credential gets revoked.

If they did something similar for law enforcement, it would probably have the same sort of restrictions: you need to authenticate to get a credential, but to authenticate you need a credential. So you need to steal one to issue yourself one.