BTW, I would not find it a bad idea if the CSSU team also addressed this subject, just like they updated the (compromised) certificates.