[andyjh]

I'm personally glad Mozilla take such an interest in ensuring CAs are trustworthy. After all, they are the linchpin for security and authenticity of just about everything on the web.

I think this post shows that Mozilla are trying to be as transparent as possible about what they expect, and thay they're proactively working with Digicert to make it as likely as possible that the new CA will be trusted. A certain amount of open-endedness is inevitable though, otherwise it'd be possible to find loopholes with enough motivation (and the survival of a business is fairly good motivation).