Yes, but in the end that's not their fault, and in a sense it's good that this happened. It was well understood from the invention of security certificates that private keys might leak and certificates will need to be revoked. Systems that were not designed with this in mind should never have been deployed, and should now be decommissioned and replaced.

It might even be sensible to intentionally revoke a small number of certificates every month, to make sure nobody is complacent.

sounds likethey're making an argument for distrusting any CA for whom CA operations aren't a core part of their business.

It rages me as well. Some random attacker could have MITM attack any https website without being noticed by anyone(including eMudhra), surely it won't contribute any to their revenue!

I mean, yeah I get your point but also if these pieces of the stack weren't prepared to deal with a compromised CA, then they were also at least a little bit negligent. There's always a chance this is going to happen. There's a chance it could happen and there not be any negligence or incompetence on the part of the CA

But at the end of the day if you're not prepared to revoke the trust of any CA you trust, it's a you problem

Part of it is on everyone else for not actually testing they key strength.