Enhancing digital certificate security (Fake *.Google.com cert issued)
I'm a bit confused why they didn't remove TURKTRUST entirely.  It's pretty obvious that they issued to a government under some kind of incentive or coercion, and thus became a MITM threat.I'm sure every reasonably sized government already has either a root key or an intermediate key, but there should at least be enough penalty when you get caught publicly to deter it -- at least raise the cost of being caught enough that governments won't use their CA powers without fear they might be putting the capability at risk each time.