The Baseline Requirements require revocation of misissued certificates, this isn't "a CA covering up mistakes."