So the allegation that "western" sites somehow do similar shady deals falls flat on its face, because the Wosign situation is all about the actions of a trusted CA. There is no comparison between trusted CAs and other random/untrusted/removed CAs.

I'm sure plenty of "western" sites have attempted to get similar deals (FWIW, Tyro, one of the companies that got SHA-1 certificates from WoSign, is based in Australia), but I'm not aware of any other CA incidents like this one. Other CAs seem to either use pulled roots or go through the proper exception process for SHA-1 issuance in the CA/B Forum. No one else has been caught backdating SHA-1 certificates to my knowledge. (For now?)

(Symantec accidentally signed a SHA-1 certificate from a publicly-trusted root while preparing their SHA-1 issuance exception application, but that's not quite as bad, I guess.)

I did not claim they were doing anything shady, just that they got those certs through out-of-the-ordinary deals.

It would be a lot more justifiable (and far better for everyone involved) if, for example, the SHA1 certs through Comodo’s pulled root were available to everyone.

That's at best off topic. We're discussing the actions and trustworthyness of a currently trusted root CA here.

I dunno - there's an argument to be made (which I'm not sure which side I'd come down on" that having a trusted CA say "Oh _those_ certs? They're ones we issued from a no-longer-trusted-root of ours! We can do whatever we want with that!" is at best disingenuous and quite possibly just timeshifting abuse of trust. The "trust" lies in the organisation, not in the individual certs. Pulling them from the root program shouldn't absolve the organisation from continuing to treat them as security-critical and shouldn't absolve them from abiding by the rules for them.

I don't want to pick on Cloudflare or Comodo right now (see my other comment in here), but if someone were to propose a rule change that says a CA's trust obligations extend to all their old retired trusted roots as well as their current and future ones, I'd be inclined to agree unless I heard a very convincing argument against it (that had some strong protections in place to stop some of the obvious abuse possibiulities).

Thought experiment: what'd happen to a CA with root trust, if they negotiated to update a root cert, replaced their old one in all the trust stores, then sold their old private key to $badpeople?