I am painfully aware of what happened with key=4, being a sysadmin at a university that uses the InCommon certificate service (which gets certs through eMudhra). What I don't get is why Oracle have decided to be the first ones to remove all of the root CAs, on a Saturday afternoon no less. I couldn't find any other projects that have done the same thing. The G3 root and its vulnerable intermediates have been the ones in the crosshairs.