alt Hacker NewsI'm not sure (but would love to know) if Sectigo actively chose to sign eMudhra's certs (though if eMudhra is a reseller of theirs, it would make sense to do so), or if maybe it was just "their turn in the barrel" to be the designated cross-signer of a new CA's certs so the new CA could be a useful entity.
Why would a CA "have" to sign anything ?
By signing eMudhra's CA, sectigo put their own responsability on the table
And by doing so without sufficient checking of the signee's quality, they prove to the world that they shall not be trusted