I've watched how Mozilla's CA process operates in past incidents, as well as in the review of new CAs, and the criteria they use and the evaluation they do seem

I've watched how Mozilla's CA process operates in past incidents, as well as in the review of new CAs, and the criteria they use and the evaluation they do seems quite transparent.