This whole thing is a little weird to me. It's prompted by the ICP-Brazil misissuance of Google certificates. I get that it's a big deal. And, if ICP-Brazil was generally in the root stores of Google, Mozilla, and Apple, I would agree that this is a real challenge to the integrity of the WebPKI.

But it's not. Microsoft is the only entity that trusts ICP-Brazil. Microsoft cut a deal with Brazil, exclusively regarding software Microsoft controls, to allow them to do... whatever it is they were doing.

You should be unhappy with Microsoft if you're a Microsoft customer. But this has almost nothing to do with the WebPKI. Microsoft could also have rigged their browser up to accomplish the same thing.