There are protocols (like OCSP) for doing online/realtime revokation, so that Verizon can announce that the Comtrust cert is invalid. They're kind of a mess, and they're often off by default.

Mozilla should just shitcan the GTE root cert (Apple probably won't, because of the iPhone relationship, but Mozilla would be enough).