IDK, I'm worried this is an example of what that will look like: since the CAs are the actual stakeholders, the default question is going to be "what can we do to make this CA trustworthy again?" rather than "how can we make sure this CA never has another cert trusted again?"