What the heck. You don't have to prove private key compromise for a CA to revoke a cert, you just ask them to revoke it. How in the world is this apple's fault?

What the heck. You don't have to prove private key compromise for a CA to revoke a cert, you just ask them to revoke it. How in the world is this apple's fault? As long as they authenticate the person requesting the revocation. In most CA's, this can be done by signing the request with the private key to prove control. Now we are told that blame "MUST" be apportioned? "HP and Apple failed in their responsibility" For all we know HP could have found a remote zero day exploit in their drivers, and was going to initiate a replacement effort or something. The author also complains no CRL is available, but that's a good thing in these cases, if there is a mistake certificate status can be updated. So again, apple has an approach here that means it's not too hard to get folks printing again. The author makes a case that a publisher can only revoke in the case of malware and key compromise. I can think of PLENTY of situations where revocation might make sense (and publisher may be still sued I'm sure) outside of that, for small teams and even for big teams.