@lizzie@brain.worm.pink a ca (certificate authority) is what basically says "yea that server is indeed that website, and not another", its private keys being out means anyone can sign their own server as any other theirs were impossibly trivial, to a point security researchers didn't even think it was possible for anyone to actually pick them, but they did anyway