Reading this I'm more worried about the personal data StartSSL has about me. I never felt good giving away so much personal data to CAs when acquiring certificates to identify myself. Do we know how StartSSL handles this? Do the Chinese now have a copy of my passport, electricity bill et cetera? (well, I've been to China already, so the state already got my passport, but not necessarily a "private" company).