Where WoSign have demonstrated glaring incompetence and utter ignorance of security practices as an CA, I doubt these issues aren't violated at quite a few doze

Where WoSign have demonstrated glaring incompetence and utter ignorance of security practices as an CA, I doubt these issues aren't violated at quite a few dozens of other CAs. These are good lessons for other CAs. To me, the ultimate question is this: if we are trusting CAs as the 3rd party entity in order to make PKI schemes work, then who's going to be auditing the "supposedly trustworthy" party?