WebPKI Observatory — Trust Surface
335 root certificates are distributed across the four major trust stores, but only 90 roots appear in all four stores and only 38 CA owners achieve universal presence. Microsoft maintains 142 roots not present in Chrome, Mozilla, or Apple, creating a fragmented trust landscape where certificate chains validated by Edge may fail in other browsers. This disagreement forces CAs to maintain multiple certificate paths and complicates incident response, as distrust decisions by one program may not affect sites viewed through Microsoft browsers.