@agwa I'm curious about the discussions on this CA, what are the issues? It is the root for several Brazilian government services, and I had the (layman's) impression that they are competent.
@bkim @agwa google.com sets a CAA record that explicitely forbids issuance by anyone except Google's own CA. A public trusted WebPKI CA is required to check this.
In the end it just adds to the list of problems that where already mentioned in the two unsuccessful inclusion requests to Mozilla. And it seems Microsoft does not care.