it concerns millions of users directly and billions indirectly. yes we can trust Mozilla and the other browser vendors to do the right thing. we already trust

it concerns millions of users directly and billions indirectly. yes we can trust Mozilla and the other browser vendors to do the right thing. we already trust them very explicitly when using their software. but the public by default approach is pretty good for these things. IETF, NANOG and other big org lists are also public. yes as all mailing lists there are occasional flareups. (and yes browser vendors or various CA/B forum members can still start a shadow list to conspire) ... but the business impact happened when they did the not-the-right thing, to minimize their impact they could have declared this an incident, suspend issuance, withdraw from the trusted set and apply again later. they again did the not-the-right thing by trying to bullshit their way to minimal impact. it's not exactly virtuous, but quite understandable to throw a few rotten eggs. (and the list could be CA/B members & candidates only).