I think it's important to also notice that attackers (most recently Duqu) are increasingly often using valid certificates. The more parties you trust, the easier it is for an attacker to find a weak link.