Ban is a strong word. What I'm saying is that if I were a CA, it is against my interest to project the idea that I take proactive effort against my customers. I

Ban is a strong word. What I'm saying is that if I were a CA, it is against my interest to project the idea that I take proactive effort against my customers. I'm warmer to the idea of being picky on which clients to take but even that is a picky topic. Like you said, it doesn't matter what is legal. Media will have a field day talking about my CA should someone like Ashley Madison be my client. But that's just the beginning. There will be cases against me because well f#$% me, right? I mean I took steps in case A and was unable tondonsonin case B. It doesn't matter if the case has no merit. If there are enough of them, it still distracts me significantly from my job. At least that's my perspective. I've never run a CA so I'm sure I don't understand the subtleties but the way I understsnd it, perhaps CAs would be better served to restrict themselves to authentication. Now, that's not to say that CAs should do nothing. For example, if your own private keys are compromised I can imagine a scenario where you'd move quickly to invalidate everything underneath. But I guess these are technical and security reasons not fear of a media backlash.