Right, I've gotten certs before. I'm saying that they could be faking certs for their own usage, and we're also assuming they have subtle backdoors in openssl, for example, to perhaps render having the private key moot.