"including Thawte, VeriSign, Equifax, GeoTrust, and RapidSSL"
RIP RapidSSL wildcard
RIP RapidSSL wildcard
I'm not sure what it says that Google doesn't trust the company that operates the registry for .com
Don't read too much into Alphabet/Google using other gTLDs instead of .com, like https://abc.xyz or https://blog.google -- that's separate work done by separate people on a separate team.
On the other hand, I’m positively surprised by how well DENIC (.de) handles it all.
LE wildcard certs will only be DNS validated and not using a web server (for obvious reasons, when you think about it)
They are? It seems pretty clear to me. Symantec's old infrastructure will be distrusted in Chrome beta in September 2018. At that point, no certificates issued by Symantec's old root certs (including those issued after June 1, 2016) will be trusted.
However they didn't say when they would do that.
If you are a site operator with a certificate issued by a Symantec CA prior to June 1, 2016, then prior to the release of Chrome 66, you will need to replace the existing certificate with a new certificate from any Certificate Authority trusted by Chrome.