My textbook for CompTIA Security+ has the following practice question:
In which one of following PKI Trust Models is the root NOT a single point of failure?
- Single CA
- Hierarchical CA
- Online CA
Now, I immediately dismissed Single and Hierarchical as wrong. I briefly considered Online, but decided that having the CA accessible would have no effect on the whether it was a single point of failure. Therefore, I finally chose Self-signed, because there's no single point of failure; each machine is its own CA (I overthink things sometimes). It turned out that I was wrong and that Online CA is the correct answer.
Why is that? How does having the root CA be online make it not a single point of failure? Isn't online vs offline tangential to the question of whether the CA is a single point of failure? Is there another meaning for "Online CA" besides having the root be accessible for certificate-related tasks?