Comment by sippingabonedry

Here's a question for Mozilla et. al.:

It's cute you have a magic DIY CRL. You accepted these assholes into your root program.

They lost the KEYS.

What is the screening process for CA's that can't be bothered to use a HSM?

Even Honest Achmed wasn't this careless.