The business model of StartSSL seems to be rather simple: You pay as soon as a human being's work (or other substantial effort) is necessary. With regard to r

The business model of StartSSL seems to be rather simple: You pay as soon as a human being's work (or other substantial effort) is necessary. With regard to revocation, I do not understand the complaints since the deal with StartSSL was pretty clear and revocation does not work in practice anyway. That does, however, NOT mean that a server has to remain vulnerable, just get another certificate …