Problem
When connecting to a website using SSL or TLS, where do we obtain the public key belonging to the certification authority (CA) that issued a server's certificate? What would happen if we had an incorrect public key for the CA, or if we accepted the public key of a CA that is not worthy of our trust?