Their certs are also baked into hardware and a large part of the Dutch e-Government. Diginotar has more than 10 employees. They do other things than merely signing certs.

Size of the company doesn't really matter too. If it matters we would have a single CA.

Apparently even my new passport is signed by the Diginotar PKI. I'm wondering when this will be big news in Holland.