Actually, it looks like they're pressuring Microsoft to release a Windows Update patch for this in a staggered way, so that authorities and companies have time to update certificates... Sounds like bad practice to me.

EDIT: Oh, and there's a good reason why the DigiNotar PKIOverheid is now also rejected. The Government cert business was supposed to be on a seperate network, on computers (or data?) stored in a safe. However, there were links between the normal network and the secondary (government) network.