Let's be real - there was no way for them to recover their way out of that after this ridiculously bad screw-up.

Sure there was - rebrand and change names, maybe once or twice until the public loses interest to keep talking about it.

Or silently spin out a subsidiary under a new name who takes over the cert business, and redirect existing customers there for renewals.

Yes they didn't close down the business, it was already gone. There's not a business called "selling certs that aren't accepted by any browser or OS". That's not a product.

Absolutely no way any OS or browser manufacturer forgives them and let's their certs validate anything in the future.