Comodo is a root certificate authority. Is this grounds for removing their root cert from Firefox and making all Comodo certs invalid?
What privacy-minded users need is a trusted list of root CA's and a (relatively) easy way to instruct their browsers to use only that list. For example, The Hong Kong Post Office is a CA installed in your browser and you can choose to delete or distrust it. Same thing for Turktrust, AOL, etc.
I imagine there are plenty of other CA's which could be distrusted but I don't know enough to make an informed decision and I don't want to start deleting them randomly and breaking my browsing experience. I'd love to see a list curated by a trusted organisation like the EFF or the Open Rights Group, which I could refer to when choosing which CA's to remove from my browser.
This is the attitude that, I think, make these problems possible. There is a time when you should care about collateral damage - say, when deciding whether or not to install malicious crapware that steals from people and/or throws feces in their faces while they browse. But here, it's time to have balls. They should pull it.
Because right now, Comodo literally pulled off the Honest Achmed move[0] - they sold so many certificates that apparently they can do whatever the fuck they want and no one can do anything, because everyone is afraid of breaking browsing for many users.
I say, break it. People will get annoyed, but they will notice. They will learn what happened. A lot of companies will need to spend time and money on new certificates. Let them. They'll learn who fucked them over, and learn to be more careful with who to trust. Not doing anything shows only that the chain of trust is toothless.