WebPKI Observatory — Trust Surface
335 root certificates span four major trust stores, but only 90 roots appear in all four programs and just 38 CA organizations hold universal trust. Microsoft maintains 142 roots not trusted by Chrome, Mozilla, or Apple, creating substantial operational complexity where certificate chains valid in Edge fail in other browsers. This fragmentation forces CAs to maintain multiple hierarchies and complicates incident response when programs disagree on remediation timelines.