alt Hacker News> The external consequences are usually immediate bankruptcy of the CA after the investigation concludes.
It would seem that we have different definitions of "wind-down". Everyone in the business operated with this consequence already on the table and it did not seem to provide the desired outcome.
So you want jail time for people whose certificates get revoked? Or what else could there possibly be? Deterrence doesn't actually prevent mistakes and accidents, that's why bridges still collapse even with the consequences you described on the table. And I haven't seen it on HN yet, but Dread, the front page of the dark web, covering many illegal topics, where the potential consequence of a private key leak is death, leaked their private key.