Maybe people shouldn't sell cell phones to drug dealers.
There's no easy way to implement such a policy. There's an easy way to implement a policy of "revoke blatantly criminal websites that get reported to us".
If a site is "blatantly criminal" then it should be an easy thing to get a court to agree and issue an action against them.
I'm surprised that CA guidelines even allow CAs to take website content into issuing procedures.
Are you proposing a law to ban this? Would this apply to any company deciding not to do business with a customer for legal reasons?
>It provides excuses to refuse to issue certificates based on how they feel.
A CA is perfectly within its rights to do that, though! As far as I know, no law obligates CAs to serve everyone.
I'm not sure why you are trying to turn this into legal issue for companies. Of course they can do whatever they want. But then Mozilla and others should respond by revoking trust.
Specifically, no trusted CA should be revoking or refusing certs on non-identity issues. That seems like a perfectly reasonable requirement to hold CAs to as part of including them in default trust stores.