i would say the relevant "this is how it works" is having a globally trusted CA system that isn't abused by large CAs just because they think no one will dare p

i would say the relevant "this is how it works" is having a globally trusted CA system that isn't abused by large CAs just because they think no one will dare punish them. What would any of these large Symantec customers says if in the future their security was compromised due to mis-issued certificates? I doubt they'd be thrilled they were saved some dev time getting their certificates signed by another root in exchange. it's very clear from Symantec's language here and elsewhere that they wouldn't be doing shit about this is chrome weren't taking it so seriously