Question: what about the other trusted roots? Has anyone tested them?

I’ve tested most of them (from historical archives) and have automated testing any new CA certificates that show up in CT.

I’m calling the check “luggage code entropy” (1 byte).

It was a mistake to trust so many root CAs and misapply the same level of trust where clearly it is impossible to independently verify and most of the accountability is smoke and mirrors. We need to be asking “why” here, the stated reason needs to be much more than “because webtrust audit” and “we recorded the entire operational process for key material handling on YouTube with this open source implementation of key ceremony tooling and have underwritten the strength of the private key with a few $mm dollars, to be paid out to the rest of the roots for the shared reputational damage to the entire ecosystem should we fuck up (intentional or otherwise).