The presence of the unobfuscated malware suggests that it originates with them, instead of it being an unwitting component of their application. In other words

The presence of the unobfuscated malware suggests that it originates with them, instead of it being an unwitting component of their application. In other words: it suggests that the CA and the malware creator are one and the same, which was then further substantiated by their shared executives, addresses, etc.