Ban is a strong word. What I&#x27;m saying is that if I were a CA, it is against my interest to project the idea that I take proactive effort against my customers. I&#x27;m warmer to the idea of being picky on which clients to take but even that is a picky topic.<p>Like you said, it doesn&#x27;t matter what is legal. Media will have a field day talking about my CA should someone like Ashley Madison be my client. But that&#x27;s just the beginning.<p>There will be cases against me because well f#$% me, right? I mean I took steps in case A and was unable tondonsonin case B. It doesn&#x27;t matter if the case has no merit. If there are enough of them, it still distracts me significantly from my job.<p>At least that&#x27;s my perspective. I&#x27;ve never run a CA so I&#x27;m sure I don&#x27;t understand the subtleties but the way I understsnd it, perhaps CAs would be better served to restrict themselves to authentication.<p>Now, that&#x27;s not to say that CAs should do nothing. For example, if your own private keys are compromised I can imagine a scenario where you&#x27;d move quickly to invalidate everything underneath. But I guess these are technical and security reasons not fear of a media backlash.