Although, how many of those are root CAs in Firefox?<p>I'm more than a little leery about this, but at least if there is a security breach due to this, it should be traceable, right?  I mean, if a CA signs a faulty certificate, their signature is part of the certificate, so it should be traceable.  So, without any evidence of wrongdoing, how are they any worse than Verisign?  Or any of the cheap SSL certificate providers?  It's not like the CNNIC is going out of business anytime soon.