When a browser validates an HTTPS website's SSL/TLS certificate, which statement correctly describes how trust is established through the certificate chain?

TLS/SSL trust relies on a hierarchical chain of digital signatures: the web server presents its own certificate, which was signed by an intermediate Certificate Authority, whose certificate was in turn signed by a root CA. The browser (or OS) walks up this chain, verifying each signature, until it reaches a root CA certificate that is already pre-installed and inherently trusted in its local trust store — at no point does the browser need or receive any CA's private key, since signature verification only requires the corresponding public key.