You can add the intermediate CA to your block list, presumably the distros will do this
Looks like archlinux already did. After update my fake st*pe.com cert no longer verifies. Ufff.
alt Hacker News
Looks like archlinux already did. After update my fake st*pe.com cert no longer verifies. Ufff.