Does anyone know how many other browsers have the CNNIC as a root CA?
Given the demographic of Firefox users, I think that this could end up being a huge PR problem for Mozilla.
Edit: After some checking, CNNIC is a root CA in both Windows and Mac, so I don't think that there was much avoiding this for Firefox.