"Wayne" himself noted that you'd think someone else would have checked this before be did!, which points to a process problem where there's no-one who's specifically responsible for running basic double-checks against widely-trusted certificates in general for issues like trivially recoverable private keys.
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/JESKy8XoAgAJ