You're making a lot of assumptions about the terms under which this certificate was issued, which you don't know. Without seeing the contract between Symantec and Blue Coat you can't claim that they're bound by Symantec's CPS.

And even if they are bound by Symantec's CPS, they can do a lot of damage before the CPS can be enforced.