So the ICP Brazil thing is interesting. It's not a certificate intended for use on the web in general. It's an open finance certificate designed for use within

So the ICP Brazil thing is interesting. It's not a certificate intended for use on the web in general. It's an open finance certificate designed for use within that ecosystem within Brazil, and it was issued to a google subsidiary who would have requested it to have that common name, and who would have been evaluated as being authorised to have such a certificate within that context. The main problem seems to be that the root certificate was in the MS keystores, and seems to have previously been submitted to mozilla (and maybe others) for inclusion, which points to a poor separation of concerns for that CA. They clearly wanted to be a general web authority at some point, but were repurposed. So it's hard to see it as purely a "misissuance", and it's definitely not malicious.