The whole point of auditing is to detect problems before they become big, embarrassing, messy failures that put users at risk. If you hang out on mozilla.dev.s

The whole point of auditing is to detect problems before they become big, embarrassing, messy failures that put users at risk. If you hang out on mozilla.dev.security.policy for a while, you'll see plenty of examples of audits exposing weaknesses or sloppiness on the part of CAs, and receiving the resulting pushback from browser vendors. Here's the most recent example I've found: https://groups.google.com/forum/?fromgroups=#!topic/mozilla.dev.security.policy/Mezqdljjerc https://groups.google.com/forum/?fromgroups=#!topic/mozilla....