Yahoo included their cert private key inside the Axis Chrome extension... (means anybody can sign extension as yahoo)...