found another CA in team#41154

howto/tls.md

@@ -249,6 +249,11 @@ time of writing (2020-04-15):
    certificate signed by a standalone, self-signed X.509 certificate,
    documented below. it is used for backups (Bacula) and mail deliver
    (Postfix)
+ * contingency keys: three public/private RSA key pairs stored in the
+   TPA password manager (in `ssl-contingency-keys`) that are part of
+   the preloaded allow list shipped by Google Chrome (and therefore
+   Firefox), see [tpo/tpa/team#41154](https://gitlab.torproject.org/tpo/tpa/team/-/issues/41154) for a full discussion on
+   those
 
 [upstream documentation]: https://puppet.com/docs/puppet/latest/ssl_certificates.html
 [Digicert]: https://www.digicert.com/