Well, I rarely have to deal with these things directly because it mostly falls to Langley and Palmer. But anything involving the CAs always feels like far more

Well, I rarely have to deal with these things directly because it mostly falls to Langley and Palmer. But anything involving the CAs always feels like far more work than it really should be. Both Mozilla and Chrome have root certificate inclusion policies that clearly outlaw this kind of behavior (assuming I'm reading correctly), but the CAs have operated for so long without any transparency that many of them are less than consistent on compliance. So, when we find violations we make them fix it, but it's a painful process because the mess is usually bigger than it appears on the surface, and you don't want to break all the innocent sites that are relying on the CA. That said, I feel like our team and Mozilla's are making some real progress here on a path toward a far more transparent and reliable CA system. And things like pinning and reporting are useful both as stopgaps and longterm tools for more security conscious site operators.