The issue is that Firefox still includes CNNIC by default. A few hundred (thousand?) people on the planet know that's a horrible idea.[1] When the community can

The issue is that Firefox still includes CNNIC by default. A few hundred (thousand?) people on the planet know that's a horrible idea.[1] When the community can't manage a no-brainer, pro-user change from the Mozilla foundation, maybe there's something to the compounded self-interest problem? This isn't to say TOFU/POP is the right move. But there's a very real problem here. One that HTTPS's strengths do nothing to address or offset. [1] And of those, I doubt they all remember to check their CA list at every browser install/upgrade/borrowed laptop browsing situation.