Comment by GaN-on-SiC

I can't confirm but it is likely to be: https://bugzilla.mozilla.org/show_bug.cgi?id=2082703. Follow-up sets a next deadline of the 22nd for revocation.

Your certificates should never be signed by the root - this is prohibited by the CA/B Forum (see Baseline Reqs 6.1.7). My understanding of best practices is that the root signs intermediates then is taken offline ASAP, and the intermediates sign leaf certificates.

Re: Starfield, GoDaddy (and AWS) use the name in trade but operate the issuance. The dev-sec-policy mailing lists should detail any transfers of ownership (in which cases, it is common to maintain an old brand name under a new root).