WebPKI Observatory — Geographic Risk
US-incorporated CAs issue 92% of trusted certificates despite representing only 15 of the 89 trusted organizations. Europe hosts 44 CAs but accounts for just 8% of issuance, while 17 Asia-Pacific CAs collectively represent 0.1% of the market. This geographic concentration means most of the web's encryption infrastructure operates under US corporate law and is subject to US policy decisions, separate from the legal jurisdiction risks covered elsewhere.