The article makes a generalization that is not correct in most cases around certificate request and issuance -- "And fundamentally you have to trust that they

The article makes a generalization that is not correct in most cases around certificate request and issuance -- "And fundamentally you have to trust that they who hold the Queens aren’t dishing out copies of your certificates." The entity holding the Queens can give out a copy of your certificate, sure, but in most cases, they do not hold the crown jewels -- your private key -- which is the part of the Heartbleed bug that is really bad. There have been cases of CAs either issuing or being compromised and issuing new certs which duplicate a site identity, but that is different then releasing the private key of a particular certificate.