does not perform certificate signing as a certificate authority would, but does help them verify user’s identities