DigiNotar Damage Disclosure (with full list of issued certs)
  The most egregious certs issued were for *.*.com and *.*.org

Why is that even possible? Does it ever make sense for that to exist? If the browsers currently accept that, I wouldn't be surprised if they stop accepting that since it almost certainly means someone got ahold of certs they shouldn't have.