Hacker News Reader

wouldn't they have to be an emudhra customer (their ssl certs signed by emudhra)?

If I understood correctly, emudhra was able to issue certificate to any website.

Therefore if some device trusts emudhra root certificate...

Google usually does certificate pinning. They know that the CA root store is not to be trusted to sign for their own domains.

I assume that devices unable to do certificate revocation will also not do certificate pinning.

only if they couldn't brute force their private keys. one of which i can fully recite from memory right here: 4