System Credentials

On to the next understanding topic. I understand the concept of credentials and why they are needed with the isolation of machine admin authority and running a SQL Server instance. I had a question on the purpose of the system credentials.

##MS_SQLResourceSigningCertificate## is the credential utilized by the instance itself to gain access to Windows for such things as reading and writing to database files, network stacks, writing to the error logs/event logs, etc. ##MS_AgentSigningCertificate## is the credential that is used by SQL Server Agent for accessing any necessary Windows resources.
##MS_SQLReplicationSigningCertificate## is used only by the replication engine to allow it to access Windows resources.
##MS_SQLAuthenticatorCertificate## is used during the authentication process for SQL Logins to provide authenticator services and is also used to access the Windows security API.

Each of the credentials is a certificate which is loaded into the instance and you can find the corresponding certificate within the data folder for the instance. I'm assuming that a mechanism is already in place to prevent someone from mucking with the certificates on the OS to gain access back into the SQL Server by comparing the signature already stored within the instance with the signature of the certificate on the OS. (This is also part of the larger discussion of certificate use within SQL Server itself and explains why you can't change the service account/password using the Service Control Applet.)

Did I get that correct, am I way off base, or is this one of those "no comment" items?