WebPKI Observatory — Long Tail Risk
74 CAs operate with full trust store inclusion while collectively representing the minority of issuance volume, creating asymmetric risk where low-volume operators face identical compliance requirements as major providers. These tail CAs contribute disproportionately to governance overhead, generating incidents that require root program review despite serving small constituencies. The combination of full trust privileges and minimal operational scale means a single compromised tail CA can issue certificates for any domain on the internet while serving fewer than 0.1% of actual users.