With a caveat, which sends a pretty strong and clear message: > We plan to distrust only newly-issued certificates to try and reduce the impact on web users [.

With a caveat, which sends a pretty strong and clear message: > We plan to distrust only newly-issued certificates to try and reduce the impact on web users [..] Our proposal is that we determine “newly issued” by examining the notBefore date [...] therefore WoSign/StartCom could back-date certificates to get around this restriction. And there is, as we have explained, evidence that they have done this in the past. [...] if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots.