The F?!
So, this happened:

Yahoo included their cert private key inside the Axis Chrome extension.. (means anybody can sign extension as yahoo)..
Shared publiclyView activity