Nothing to do with law. CAs are bound by the requirements that Mozilla, MS, Google and others set out. These requirements obviously go far beyond the law. For i

Nothing to do with law. CAs are bound by the requirements that Mozilla, MS, Google and others set out. These requirements obviously go far beyond the law. For instance they require that a CA issue certs to the public (IIRC), so you can't become a trusted CA if you're only issuing for your company. I'm not sure why you are trying to turn this into legal issue for companies. Of course they can do whatever they want. But then Mozilla and others should respond by revoking trust. Specifically, no trusted CA should be revoking or refusing certs on non-identity issues. That seems like a perfectly reasonable requirement to hold CAs to as part of including them in default trust stores.