Why are the intermediates, and not the root cert, being revoked?
The intermediates seem to be difficult in that the root stores don't seem to have a mechanism for it (… kinda seems like an oversight, at this 20:20 vision point?). If eight of the CA's intermediates are hosed … how many are still "good", and are they good good, or are we just fooling ourselves?
At least Google and Mozilla are revoking the roots too
There are 30k websites using certs chained to that root
I guess the other question I have is just how many intermediates does this one CA have? They've had 8 compromised thus far; that's not the entire lot of them?
LE has two EC intermediates, by comparison.
You know the old saying: if you find 8 cockroaches in your house, then a realistic estimate for the total number of cockroaches in your house is exactly 8.
money > security