This has been planned for a while now. Between Let's Encrypt and StartCom, Debian and SPI don't need to run a CA anymore, especially not a CA that only Debian systems trust. Several Debian sites used to use SPI certificates, back when HTTPS seemed like an optional nicety. These days, every connection should use HTTPS, so Debian sites need to use certificates that all browsers trust, which they can easily do now.
SPI actually got an offer to cross-sign their root so that all browsers would trust it, but the consensus was that SPI didn't want to take on that risk given the availability of multiple other free CAs.
https://lists.debian.org/debian-devel-changes/2015/11/msg025...
This has been planned for a while now. Between Let's Encrypt and StartCom, Debian and SPI don't need to run a CA anymore, especially not a CA that only Debian systems trust. Several Debian sites used to use SPI certificates, back when HTTPS seemed like an optional nicety. These days, every connection should use HTTPS, so Debian sites need to use certificates that all browsers trust, which they can easily do now.
SPI actually got an offer to cross-sign their root so that all browsers would trust it, but the consensus was that SPI didn't want to take on that risk given the availability of multiple other free CAs.