What a Compromised Certificate Authority Teaches You About Getting Recommended by AI
A Four-Digit Key and a Broken Chain of Trust
Every browser on your computer trusts a short list of companies to vouch for the websites you visit. That trust is called a certificate authority, and the whole system runs on one assumption: the authority's private key stays private.
Eyeball CA eMudhra found out what happens when that assumption breaks. A privately held signing key tied to the company was exposed, and once that happened, browser makers had no way to confirm which certificates issued under that key were legitimate and which weren't. The key itself doesn't need to be stolen by a sophisticated nation-state actor to cause damage. It just needs to end up somewhere it shouldn't be.
What followed wasn't a slap on the wrist. Browser vendors, who act as the gatekeepers deciding which certificate authorities get automatic trust, began the process of removing eMudhra from their trusted root programs. Years of being a recognized, trusted verifier collapsed because the mechanism that proved legitimacy stopped being reliable.
This matters well beyond the world of SSL certificates. Any system built on being vouched for by a verifier runs on the same logic. The verifier checks your credentials, decides you're trustworthy, and tells everyone downstream to believe it. The moment the verifier stops vouching for you, the downstream trust disappears with it, regardless of how long you'd built it up.
AI Engines Are Verifiers Too
Swap out "browser" for "ChatGPT" and the eMudhra story stops being a certificate authority problem and starts being a preview of what's already happening to your business.
ChatGPT, Perplexity, and Google AI Overviews are doing the exact same job a certificate authority does. They're deciding who gets vouched for. When someone asks one of these tools to recommend a plumber, a software vendor, or a marketing agency, the AI isn't running a Google search and handing back ten blue links for the user to sort through. It's making a call. You're either part of the answer or you're not in the conversation at all.
That's a harder binary than anything the old search engines ever imposed on you. Page one versus page two was a spectrum. You could claw your way up a few spots a month and still generate traffic the whole time you were climbing. AI recommendation doesn't work that way. The model either trusts enough signals about your business to include you in its answer, or it skips you entirely and recommends a competitor it trusts more.
The eMudhra lesson applies directly here. Trust that took years to build can disappear the moment the verifier's confidence in you breaks down, and the verifier's confidence is the only thing that ever mattered.
The Signals These Tools Actually Check
So what does the verifier actually look at before it decides you're worth recommending? Four things come up again and again when marketers dig into AI visibility.
Schema markup is the technical layer. It's the code on the back end of your website that labels what you sell, what people say about you, and what questions you answer, so the AI isn't left guessing based on how your homepage is laid out. A local business with product schema, review schema, and FAQ schema has handed the AI a clean file to work from. A business without it is asking the AI to interpret a page the way a human would, which is exactly the kind of work these tools are trying to avoid.
Review consistency matters just as much. If your five-star reviews on Google don't match the tone of what people say about you on Yelp or Facebook, that's friction for a verifier trying to build confidence.
Pricing transparency is a trust signal because cost is the first question in nearly every buyer's journey, and a business that won't answer it looks like it's hiding something.
Claims need sourcing. Calling yourself the best in your market means nothing to an AI unless there's something backing it up, like an award, a certification, or outside coverage it can point to.
Keeping Your Trust Score Intact
None of this is a one-time setup you check off and forget. eMudhra didn't lose its trusted status overnight after years of good behavior — the exposure happened, and the downstream consequences followed close behind. AI trust signals decay the same way if nobody's watching them.
Put a recurring check on your calendar, weekly if you can manage it, monthly at minimum. Ask ChatGPT, Perplexity, and Google's AI Overview directly what they know about your business. What do they say you do? Who do they say you compete with? Do they get your pricing right? You'll catch outdated information, dropped context, or competitors creeping into answers where you used to show up alone.
Content freshness needs the same attention. Go back through your schema markup and confirm the "last updated" field actually reflects reality rather than a date you set once and never touched again. A page that says it was updated eighteen months ago is telling the AI it's looking at something stale, even if you've quietly revised the content since.
Check your reviews across platforms for consistency while you're at it. A five-star Google profile sitting next to a neglected, out-of-date Yelp page sends mixed signals to a verifier that's trying to decide how much to trust you this week, not last year.