A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

It gets worse. ICP-Brasil, the AC mentioned in the bug reports, the the government run agency responsible for all things related to digital signatures. Digitally signing a contract, a deed, accessing tax returns…

Unlike web browsers, digital signature use cases should perform revocation checks, so revoking the google.com certificate should solve that.

I think the current "meta" is CAA records? https://blog.cloudflare.com/why-certificate-pinning-is-outda...

The problem here isn't really that one mis-issued certificate, but rather the general problematic behavior of that CA reported in TFA.

If a CA can be convinced to issue a server certificate for google.com, would you feel very comfortable trusting their contract/deed/... signing certificates?

Correct, which Google is using:

https://www.nslookup.io/domains/google.com/dns-records/caa/

So you're saying it's only a matter of time until they issue a cert for x.com as well? :)

If the government says you need to use their CA, you may feel the feelings, but you will still use them

Just need to DoS the revocation server right before your digital signature is checked.

CAA records rely on the CAs to respect them, and this is an article about how a CA has issued a cert in violation of a CAA record.

Oh right, for some reason I was under the impression that browsers utilize the record too.

What would stop me from purging all this CA's certificates from my computet?