I don't understand why this is newsworthy? Everybody could generate an unsigned certificate for any name in just a few seconds. The point is that they are unusable in any sane browser.
--EDIT-- Opps they did mention PK pinning as a solution. Cool.
Supposedly Google pays Mozilla $300m/yr. If we can accept that astronomical number, then WTF happens to all that money? Trivial FF changes like moving tabs above the address bar. But useful improvements like pinning languish.
With Chrome, the answer is easy. Google control the browser code, so you're implicitly trusting them anyway, and they're vouching for the certificates to their own sites, so you have good reason to accept what they say are the real certs.
With Firefox, the picture is much more hazy. The certificates being pinned aren't owned by Mozilla (at least, for the functionality to be useful you want to pin certs from other places, unless you browse mozilla's website all day long). So someone at Mozilla has to vouch for a 3rd party's certificate. Why should we trust Mozilla at this? How would Mozilla decide who to trust when they say 'honest, this really is my certificate'? And even if we accepted mozilla's judgement, all this does is make them an authority. You know, like all those other certificate authorities that already do this job. So nothing will have changed and nothing will have been improved.
The challenge is really to encourage offline authentication of DNS and SSL certificate changes. It should be something that can be put in a safe and requires physical attack to circumvent. Something permanent enough that loss would be unlikely, and would result in permanent revocation of the domain.