A CA can do a superb job of writing a detailed Certificate Practice Statement, or CPS -- all the ones we've read disclaim all liability and any meaning to the certificate -- and then do a great job following that CPS, but that doesn't mean you can trust a certificate for your application. Many CAs sidestep the question of having no authority to delegate authorizations by issuing ID certificates. Anyone can assign names. We each do that all the time. This leaves the risk in the hands of the verifier of the certificate, if he uses an ID certificate as if it implied some kind of authorization.