It is possible to use [vb/java]script to import the root CA into the browser certificate repository. If a 'startup CA' were to get a certificate from an existing CA, the startup's customers could point visitors at this site to grab the startup root certificate, before being redirected back to the client site...
I think there are also business models were you can purchase a certificate from a root CA that is valid for signing other certificates. The resultant certificates will chain back to the root CA, and be judged OK. This makes you a registration authority (RA) for the CA from memory.
Slashdot Mirror
I think there are also business models were you can purchase a certificate from a root CA that is valid for signing other certificates. The resultant certificates will chain back to the root CA, and be judged OK. This makes you a registration authority (RA) for the CA from memory.