If you think somebody else should decide - maybe the Government of Italy, or the Queen of England, or Donald Trump, or you personally, then here's a few questions for your new Root Trust Programme:
1. Why? At least Mozilla's rationale is related to a fact, they make Firefox, so it trusts whatever they decide, what would be the rationale for why the Pope gets to decide?
2. Are they actually doing it? This is largely a tedious responsibility. But, if you decide to slack off, every Firefox user gets screwed. So, you know, you're going to need to put those hours in. Forever. I've lost count of how many people or organisations decided they could do better and didn't last a year.
3. Where's the transparency? The main way Mozilla stands out from the other big trust store operators (Apple, Microsoft, Google, and arguably Oracle) is that they're a not-for-profit and so they operate transparently. Your contributions are welcome at m.d.s.policy https://groups.google.com/forum/#!forum/mozilla.dev.security... where we are currently discussing the minutiae of Certificate Policy documentation. If your alternative is less transparent, how is that not worse?
I don't know how involved you are, but to a lay observer this story seems like Mozilla's policies are entirely black and white, to the benefit of nobody (except perhaps to reduce work I suppose, which is reasonable, but not really a valid reason in terms of security)
Is there no tiered approach to risks? Hell, in this situation it seems like more harm and risk will have been created by the rush to reissue certificates that would have been caused by this theoretical security vulnerability.
Edit: Actually, on further reading, it seems like the issue is more that Actalis didn't correctly invoke their right to this discretionary power?
The CA is irrelevant, they're just a middle-man.
The best part here too is that Mozilla's link on revocation basically says "we understand sometimes it's more risky to revoke according to our policy than to take a little longer, we just don't care and will utter our disappointment in you either way".
If the majority of outstanding certificates were held by the Italian government, major banks and hospitals, what are the CA supposed to do if they're just told "No, you won't revoke the certificates until we're ready, we don't think the risk is worth it"? Further, reading a comment below on the usage of these certificates by the Italian state for mandatory reporting: it sounds like revoking could be considered a criminal offense...
This very much reads like a private entity mandating that tens if not hundreds of thousands of Euros are spent by the Italian state over a very minor security risk.