Most of their process is 100% automated. Revoking based on free-form reports would at the very least require a human to deal with the report. Also, customer se

Most of their process is 100% automated. Revoking based on free-form reports would at the very least require a human to deal with the report. Also, customer service for dealing with the certificate holder. That said, offering an API and automating as much as they can is a lot easier than receiving the reports through free-form e-mail, with followup through Mozilla's root program (https://wiki.mozilla.org/CA/Bug_Triage#Compliance_Problems_and_Incidents https://wiki.mozilla.org/CA/Bug_Triage#Compliance_Problems_a...), where the CA will have to take action or cease existing.