[nickf]

Chrome root policy, and likely other root policies are moving toward 5-years rotation of the roots, and annual rotation of issuing CAs. Cross-signing works fine for root rotation in most cases, unless you use IIS, then it becomes a fun problem.

[mikestorrent]

What an absolute pain in the ass for a mediocre increase in security.