I'm somewhat surprised that Mozilla went this route, because I recall during discussions, there was concern that explicitly blacklisting a country's root CA cou

I'm somewhat surprised that Mozilla went this route, because I recall during discussions, there was concern that explicitly blacklisting a country's root CA could lead the country to simply fork and release its own nation-state browser with the root CA trusted. That would be bad for everyone for many reasons, not the least of which being that the nation-state forked browser would likely be perpetually behind the main branch in terms of bugfixes and security updates. Maybe because Google agreed to do the same?