There was already a lot of debate about adding the CA, but the final consensus was, I believe, "as long as they don't actually abuse it, we should trust them; as soon as we have evidence of someone doing a MITM attack with that CA, we will blacklist it".
Perhaps the browser could do something subtler, but it's not straightforward. Or we could make the https cert protocol more flexible, but changing protocols is hard.
It will be interesting to see if the Chinese government makes their own alterations to the Firefox binary installers that pass through their network that add the CA back in.
Nobody checks their installers' GPG keys anyways
Wait... what???
http://www.gluster.org/2013/08/how-far-the-once-mighty-sourc...
For as long as I can remember Sourceforge's usability has sucked. That's reason enough to avoid it (but omg! free file hosting!) but the installer thing maybe isn't quite as deceptive and malwareish as your first message let on. It's just another facet of their lameness.
Kudos to Gimp for dumping them. Why does anyone stay with them at this point?