We really need to clean up the CAs. Hopefully once the lets encrypt guys gets to be operational we can nuke the rest, in a similar way to how Chrome is sunsetting the old encryption standards.