Comment by scq
13 hours ago
We should have a very small set of largely not-for-profit CAs run by competent security people, such as Let's Encrypt. There are just too many trusted CAs at the moment, it increases the risk of a breach like this substantially.
Let's Encrypt had their own security snafu. They issue certificates for longer than they were supposed to (1 extra second). It wasn't as big of an issue as this, but let's not act like they are some silver bullet
https://bugzilla.mozilla.org/show_bug.cgi?id=1715455