Sooooo.. why keep it a secret until the patch? And why not disclose the targets? If the attacker already has the bogus certs then the damage is done.. or is it?
And anyway, they didn't cover it up, they just waited for the patch. But they checked it in to the public repos days ago, so they weren't trying to hide it from the attacker, just keep it low profile. That doesn't make sense for this type of vulnerability, unless there is something interesting we don't know about.
My best guess is that we are waiting for audits of the target sites to finish, and I guess addons.mozilla.com is already done.
EDIT: Nevermind, here is the list of affected sites: http://www.microsoft.com/technet/security/advisory/2524375.m...
Edit: I mean, I can see how it's in the browser's interests to convince people that the system is reliable. And I can see how it's in web companies' interests to convince people that the system is reliable. But trying to convince people that the system is reliable when it is known not to be reliable strikes me as ethically questionable, at best.