I think they brutally expose the utter incompetence of that company.

Reasonably brutal.

As Wayne points out later in the thread, it's because those who are paying attention already know the answers but the questions are specifically designed to both confirm that eMudhra actually understands what they've done wrong and are willing to publicly acknowledge it, which is a critical factor in how an incident will affect trust going forward.

Obviously in this case eMudhra has decided they don't want the responsibility anymore which I actually respect to some extent.

It's brutal the way reading lawyer interrogatory questions is brutal. Facts, details, and specific data that hold people accountable. The language is also in legitimate government probes and incident response reports.

I'd like to say it's how journalism works as well, but that ship sailed decades ago.

> Is the Mozilla bugtracker usually a / the Go to party for these issues? Or just a coincidence in this case?

Yes, because of the project's open nature the Mozilla CA program Bugzilla and their dev-security-policy mailing list have become the de facto public discussion point for TLS-related issues.

They planned on expecting a reasonable level of competence.

There’s no excusing this. This is a company that specializes in “digital trust”. Even if they exit the TLS CA cert business, would you want to rely on them for the “post-quantum cryptography” prominently featured on their homepage?

This is a case where it would actually make sense for a government to come in and shut them down. There’s no reasonable scenario in which this is a company that anyone should use for “digital trust”, and any customers dumb enough to do that might literally need to be protected from themselves, for everyone’s benefit.

You wouldn’t have to twist my arm very hard to convince me that any customers that continue to use them after this incident should also be shut down.

The intent isn't public shaming, it's to have enough information about what the hell happened, so that the failure mode can be squashed as thoroughly as possible in the future. Other CAs and interested parties should be terrified about the possibility that they have the same cockroach infestation as a result of using the same software or similar procedures, rather than sneer about how bad the so-called "human error" was this time.