One man's "little known company with no cybersecurity muscle" is another one's "sovereign certificate infrastructure."