So a CA got caught red-handed having issued an intermediate CA that spoofed google domains ... and instead of throwing them out of the CA club, their response was to reluctantly limit them to *.fr and 12 other TLDs?<p>Explain why they aren&#x27;t permanently blacklisted and banned from ever being in the root store for any purpose again???