We need a solution to this. It comes up every time a ca misbehaves.

How hard would it be to allow a website to have multiple certs? If Turktrust's important customers had redundancy, we could pull less painfully.

Or for less rollout, could browsers acknowledge turktrust only as a root for .tr hosts? That would contain the damage, but probably not hit many legitimate customers.