Right, and that's fine and good for WoSign/StartCom. But what if they handed out a one year restriction to a much larger CA like Comodo, or Symantec? And that C

Right, and that's fine and good for WoSign/StartCom. But what if they handed out a one year restriction to a much larger CA like Comodo, or Symantec? And that CA decided to back-date their certificates? Then we still have the problem of large CAs being able to effectively ignore these restrictions because of their large userbase. As long as such CAs are able to set the notbefore arbitrarily, they can backdate as much as they'd like. The only solution I can think of is to have some kind of giant database of all certificates seen in the wild that were issued by said CA, and not trust any new ones. (This may be something that can be done with Certificate Transparency, but I haven't read enough on that to be sure.) This would allow Mozilla/Apple/Microsoft to actually block new certificates.