I am www.example.com, and my public key is PUB1.
Signed, PRI2.
I am www.signer.com, and my public key is PUB2.
I believe that www.example.com has public key PUB1.
I am allowed to sign server certificates.
Signed, PRI3.
I am www.ca.com, and my public key is PUB3.
I believe that www.signer.com has public key PUB2.
I am a certificate authority, whose public key
appears in your client's list of trusted CA keys.
Signed, PRI3.