Well it sounds like their stance is wrong if they've agreed to the Mozilla CA Certificate Maintenance Policy:
CAs must revoke Certificates that they have issued
upon the occurrence of any of the following events:
...
the CA obtains reasonable evidence that the
subscriber’s private key (corresponding to the
public key in the certificate) has been compromised
