Escrow compromise as described has a iserial systems failure probability wheres today with root keyts it's parallel. That's weakest link vs isolated/partitioned.

CAs have been nuked on occasion without much fanfare to everyday users.