> What are the consequences?

> An attacker with the private key of any of the compromised intermediate CAs could impersonate any website or service.

And how many more times do we need to read this before we replace Web PKI with a system that isn't as completely insane?

We already have a functioning system for delegating domain ownership in a hierarchical fashion where compromises are limited to only the subtree under the compromised entity. Let's start using it for domain validation sooner rather than later.