Oh sure, they need to revoke yesterday, but if a certificate was mis-issued there's downstream security impact that needs to be handled immediately. > HTTP fil

Oh sure, they need to revoke yesterday, but if a certificate was mis-issued there's downstream security impact that needs to be handled immediately. > HTTP file validation is allowed for DV certificates, so you can test a domain by connecting to it. This was validation over DNS using a CNAME record. You don't need to keep the verification records around after the certificate is issued, so post-hoc analysis won't tell you much. But worse, how does the CA know if a RANDOM.example.com CNAME record was created by a customer vs the domain owner? The underscore is supposed to solve that, and they didn't use it.