"Put all your eggs in one basket, then watch that basket". This is an issue that we more-or-less know how to deal with (HSMs, procedures, etc.) I'm more worried

"Put all your eggs in one basket, then watch that basket". This is an issue that we more-or-less know how to deal with (HSMs, procedures, etc.) I'm more worried about other parts of the CA system, like obscure CAs with bad judgment/security.