My read here is that Debian was asked to upgrade ca-certificates in April 2020 and they rolled out an update within two weeks. That sounds reasonable. I'd be more concerned about Mozilla. Why did they include the Certinomis CA in the first place? I did a Google search and it appears to be a small business in France that's owned by a stamp printing company. They should totally have the power to read my emails. Quick grep of Mozilla root file tells me they grant 138 different companies root access to SSL. Why do we need that many people trying to make a buck selling prime numbers online? It's gonzo.