[EwanToo]

But that doesn't mean their CA trusted root key has been disclosed - sure, the pem files could contain their trusted root key, but they normally wouldn't.

For example, the file named certigna.pem exists on most Linux machines, it's the public key not the private one, look at the ca-certificates package on debian.