The rules and audits don&#x27;t seem very effective: it&#x27;s not just Diginotar that has been caught issuing rogue *.google.com certificates, but to my knowledge it&#x27;s the only one that got removed from root stores.