I wonder if Entrust can survive this. Even if Web-PKI doesn't account for the majority of their income (which it might, I genuinely don't know) this is a huge blow to their credibility.
And for a CA, credibility is everything
And for a CA, credibility is everything
If you believe https://bimiradar.com/glob
it looks like Entrust is selling on the order of a few dozen certs a week to maybe upwards of 100-200.
EDIT: I've asked Google if Gmail will be discontinuing support for Entrusts VMC certificate (and thus BIMI logos), I would guess not since BIMI has some actual requirements, but assumptions are not the best way to make decisions about risk (like our BIMI logo not working later this fall).
See arguments about red-warning unencrypted HTTP and how that pushed the web to update.
Add in that genAI is going to make plausible-looking phishing emails a lot easier for the world to generate en mass, and giving the everyperson something better than "decide if it looks suspicious" is important.
A dead giveaway would otherwise have been that the BIMI issuers are all the now-panicking EV certificate issuers, which nobody will now buy.
They've pivoted to payment cards.