In reply to David Anderson.

Oh, and... remember that if the state actor can get co-operation from the data-centre where your site is hosted (whether willing, or forced through legal means), in order to just swipe your existing certificate's private key from the server - then all questions about where your certificate came from are also moot, and nothing that happens with any CA, anywhere, can make any difference to your SSL security.