[neallindsay]

"...revocation of the affected certificates is insufficient... Instead, it must be proven that all copies of the keys have been destroyed."

Isn't the main reason you would want to revoke keys because they were disclosed, making it impossible to destroy all copies?

[floatingatoll]

Normally, yes. This is not a normal circumstance though. In this scenario, the misissued intermediates effectively have sudo access to cancel a revocation issued by the parent CA. This is equivalent to being told that a non-root user could cancel a userdel command run by root. For policy compliance, the intermediates have to revoke their certificates — but since the intermediates can immediately un-revoke themselves, proof of key destruction is necessary as well to ensure that they cannot.

[jakear]

Further, if I can destroy all keys do I even need to revoke the cert? (Honest question, I’m actually not sure)

[floatingatoll]

Revocation is required by policy, so the question is technically moot. It’s generally good practice to generate and publish a revocation prior to destroying a private key, though.

To provide an analogy in the context of PGP keys, if an attacker somehow finds a backup of your revoked and destroyed private key someday, they will have trouble using it because your revocation will be public and on record.