It's quite worrying for security; imagine if some API used by some slightly older code uses an .eu, now someone can go but that domain, issue a trusted certific

It's quite worrying for security; imagine if some API used by some slightly older code uses an .eu, now someone can go but that domain, issue a trusted certificate and hijack the system using it. Of course the risk is no greater than usual but the same could apply for fraudulent sites popping up.