Those tickets sound fairly non-dramatic - a trusted root certificate was dual-use, in breach of root certificate policy, and have committed to transition to TLS-only certificates and remove trust in the old ones.

But the Go issue is market urgent, and assigns it a CVE, so clearly there's more to it than that.