>However, several CAs disliked having to revoke all those certificates, because it cost them staff time (and hence money) to do so. They went so far as to chang

>However, several CAs disliked having to revoke all those certificates, because it cost them staff time (and hence money) to do so. They went so far as to change their procedures from the standard way of accepting problem reports (emailing a generic attestation of compromise), and instead required CA-specific hoop-jumping to notify them of compromised keys. It would have been nice to have names be named. This is obviously in bad faith, and the bad actors should be called out. Given that Matt Palmer is an active participant of the MDSP (Mozilla Dev Security Policy) mailing list, I am surprised that I don't recall seeing discussion about this pop up, although I may have missed it. The CAs acting this way really should have to explain themselves.