Crypto question: can a Certificate Authority (eg, Verisign) decrypt data encrypted with keys they generate? Or is that not possible?