This is so blatantly abusive that wosign and startcom needs to be pulled from all trusted root CA stores immediately. If their SSL cert clients' websites break, so be it. This is outright malicious behavior.

The internet engineering community would come down like a ton of bricks if somebody registered ripe.cn and decided to impersonate RIPE. Same principle.