Debian had some fairly dubious CAs included for almost 10 years, so they're not without fault. Looks like they've cleaned up - and at least their processes are

Debian had some fairly dubious CAs included for almost 10 years, so they're not without fault. Looks like they've cleaned up - and at least their processes are fairly transparent. https://lwn.net/Articles/590879/ https://lwn.net/Articles/590879/