What we need is for Microsoft, Apple, and Mozilla to settle on a plan to collectively eliminate negligent CAs. It seems like existing CAs would have to hand out valid certs to Hitler before they are removed from the trusted root store. We already have high standards for any new CAs to be added, why can't we have high standards for CAs to keep their trusted status?

We don't have to either do nothing or revoke the CA entirely. We could just only trust certificates with an issue date before a certain deadline. When the next DigiNotar or Comodo pops up just set a deadline of 3 or 6 months to revoke their status as a CA. No customers would be harmed by this, they have the rest of the lifetime of their cert or 6 months to move to a decent CA. This would be a clear stop to an untrustworthy CA without the negative ramifications for any party other than the CA itself. And 5 years or so after the deadline has past, all of their certs are invalid anyways and the CA can be completely removed. If the CA starts issuing bogus certs with a forged issue date, just remove them immediately and make sure that every CA knows that this is the process for removing a CA.

Maybe we wouldn't have CAs in the news every year if there were actual consequences for existing CAs.