Certificate authority CA
A trusted third party that signs certificates, thereby vouching that a public key belongs to a given domain.
All of TLS rests on your browser shipping a preinstalled list of root CAs. The root key is rarely used; it signs intermediate CAs which in turn sign end-entity certificates, so a compromised intermediate can be replaced without updating every device.
The model's weakness is that it is only as strong as its weakest member — any CA can issue a certificate for any domain. The 2011 DigiNotar breach demonstrated this in practice. Certificate Transparency logs are the countermeasure: every issued certificate is publicly logged.