I agree with you. I think it's unethical not to publicly announce this one. I understand that some bugs may be best treated in private, but compromised certificates can cause real havoc.