Comment by polynomeal

Does anyone know how browsers go about deciding which CAs to trust? It seems like browsers should be auditing CAs if they are going to be making this decision on our behalf. An audit should have caught this design flaw.