Good point. Is there any legal precedent (in the US) for forcing signature revocation though? It seems to run up against the first amendment since Mozilla would

Good point. Is there any legal precedent (in the US) for forcing signature revocation though? It seems to run up against the first amendment since Mozilla would essentially be making a statement that "the addon with hash 1234 does not contain malware", which should be legally protected speech.