When reviewing a digital certificate for accuracy, which of the following would Matt, a security administrator, focus on to determine who affirms the identity of the certificate owner?

A trust model describes the framework and hierarchy by which CAs are trusted, but does not itself affirm any individual certificate owner's identity.

A Certificate Revocation List (CRL) lists certificates that have been revoked before expiry and is used to check certificate validity, not to affirm identity.

The CA is the entity that vouches for and affirms the identity of a certificate owner by signing the certificate with its private key. When a relying party trusts the CA, they transitively trust the identity bound to the certificate. Without a trusted CA signature, a certificate has no authoritative backing.

A recovery agent is used to decrypt data when a user's key is lost, which has no role in affirming the identity of a certificate owner.