SSL certificates and MD5 collisions

1. a particular signer is comprimized/doing things wrong

in this case RapidSSL had done two major things wrong
A. they didn't update to not use MD5
B. they used sequential serial numbers.

2. something fundamental in the signing/encryption mechanism is broken

it can be argued that the MD5 problem really falls in this category.

with PGP/GPG you get signatures from many different people. As such the odds of all of them doing things wrong is much lower (they create their keys at different times, with different versions of software, using different options for creating their keys, eetc)

if somthing is fundamentally broken in the core mechansim it could still break everything.