DNS over HTTPS in Firefox

Yes, the way that happened starts with Symantec being told the old roots have to go away. Symantec was to build completely new systems, fresh roots, re-train staff, and so on. Since that obviously could not be done (at least correctly) overnight, they were to bring in a third party, which would have to be a big existing public CA, to host infrastructure until they could cut over to their new systems after re-gaining our trust.

I don't know how far Symantec got into that plan exactly, but somewhere between asking DigiCert "Can you help us?" and actually executing the plan changed into DigiCert acquiring the CA roots, branding, goodwill etcetera from the Symantec business. There was plenty of scepticism on m.d.s.policy but DigiCert seem to have been very diligent about this, I hope it's paying off for them profit-wise in proportion to the effort they must have spent.

One of the things that eased minds at m.d.s.policy is that DigiCert seems to understand the old roots had to go, and there was no foot-dragging, "mistakes" where old certificates have to be grandfathered in and so on as we'd come to expect from Symantec.

The end result will be that cryptographically nothing inherited (at presumably considerable expense) from Thawte, Versign, etcetera is left standing, that's all gone. In terms of infrastructure it's all DigiCert, in terms of staff, leadership is DigiCert there may be particular personnel even on the crypto side who are Symantec, but leadership is where it all went wrong previously so that's not a great worry. For customers, I suspect much of the branding and maybe sales teams are kept from Symantec, if you have a customer paying $5000 for Verisign, well, that customer probably doesn't care about some rotten ten year old 2048-bit RSA root from the actual Verisign, they just remember the brand name, and DigiCert have bought that.

From a trust perspective what we (m.d.s.policy, anybody paying attention) didn't trust was Symantec executive level management and thus the roots which had been under the oversight of that management. Negligence, incompetence, malice, I don't know and I don't care, personally as a lay person my suspicion is incompetence, I think the Symantec board hasn't the first idea what they're doing, and it was just more obvious to us, and we were better able to take action, than say, a pension fund or other shareholder.