I can't understand how someone who understands CAs enough to build a dynamic one doesn't also understand that you should build the CA certificate and private ke

I can't understand how someone who understands CAs enough to build a dynamic one doesn't also understand that you should build the CA certificate and private key dynamically at the point of installation, not when you compile. That would have changed these publicly embarrassing situations from dangerous to simply controversial. Edit: And they should know that it needs to be smart enough to deal with an invalid certificate appropriately, regardless of Subject Alternative Names or any other extensions.