Hm, by that argument I guess they (and all other CAs) should just revoke all of the ones on servers that are/were vulnerable without user intervention. I can't

Hm, by that argument I guess they (and all other CAs) should just revoke all of the ones on servers that are/were vulnerable without user intervention. I can't imagine that would make them any more popular, although it probably would be the right thing to do.