The Public Key Infrastructure(PKI) is an important part of almost all security implementations from secure portals for banks and e-shops to vpn devices. In spite of its strengths there is a critical design issue causing a single point of failure for the PKI infrastructure. Once the CA (Certification Authority) key has been stolen, the integrity of the entire system can be exposed to bogus certificates, compromising the validity of all digital identities issued under this CA. In this paper we introduce the problem and propose a solution to distribute the trust responsibility to accredited agents. The major advantage of the proposed solution is its compatibility to classical PKI based on x509 certificates.