Which entity vouches for the binding between a public key and a subject's identity?

• A. End user
• B. Key escrow agent
• C. Certificate Authority (CA)
• D. Web of Trust

Answer: (C)

Digital certificates bind a public key to a person’s identity, and a Certificate Authority is the entity that vouches for that binding. The CA verifies who you are, issues a certificate that includes your identity and your public key, and signs that certificate. When software or users trust the CA, they can rely on the CA’s signature to confirm that the public key really belongs to that identity, establishing a trusted link between the key and the person. End users don’t certify others’ identities themselves; they generate keys but don’t attest to identity in a binding sense. A key escrow agent stores keys but doesn’t verify or bind identities. A Web of Trust uses individual signatures to indicate trust, which is a decentralized approach, but the formal binding in a PKI context is provided by the Certificate Authority.