> why is Symantec still included in common roots? Because they (and the companies they own, like Verisign), are the root of about 30-40% of all active, web-vis

> why is Symantec still included in common roots? Because they (and the companies they own, like Verisign), are the root of about 30-40% of all active, web-visible ssl certs at the moment. No browser maker, even Google is going to break that much of the web over one shady intermediate cert. The consequences for users are too high and too many people are willing to excuse it because it's "only" a pathlen=0 and it would be noticed if used en masse so it's "only" useful for targeted attacks by state-actor clients.