They revoked it 7 minutes shy of the 24 hour deadline after my report. If other users reported it and they failed to act, that's a BR violation and they're req

They revoked it 7 minutes shy of the 24 hour deadline after my report. If other users reported it and they failed to act, that's a BR violation and they're required to provide an incident reports to the root programs via Mozilla's mechanisms. If they don't, and you have evidence of those reports, you should provide them to the root programs via the mozilla.dev.security.policy mailing list/group. There's already a thread about this issue, though not claiming that EnTrust was notified. (Based on timestamps, it's also possible they revoked in response to that thread).