> Then any CA who issues a cert for www.google.com will also have to publish irrevocable proof that they done fucked up; and when their CA status is revoked it'

> Then any CA who issues a cert for www.google.com will also have to publish irrevocable proof that they done fucked up; and when their CA status is revoked it's possible to grandfather in certs they've already issued to avoid breaking lots of sites. I wish. Even in cases today where we have conclusive proof of CAs willfully issuing fraudulent certificates, they get a pass. TrustWave still has a valid CA cert even after having been caught with their hand in the cookie jar. Oddly, DigiNotar got the death sentence. The only lesson I can see in this is that incompetence is inexcusable, but willfully subverting the CA system is A-OK.