WebPKI Observatory — Long Tail Risk
75 CAs hold full trust store inclusion despite negligible issuance volume, creating asymmetric risk where low-activity operators carry the same systemic trust as high-volume leaders. These tail CAs collectively represent less than 9% of issuance but account for a disproportionate share of compliance incidents, as governance programs spread limited oversight resources across 89 trusted entities. The 54 CAs implicated in the 1,531 total incidents include many from this long tail, where operational maturity lags market presence.