Once you have a wildcard cert, you'll find all kinds of places you want to start using it...the web site, the production system, the blog, the mail server, the remote access server, and so on. But effectively they mean that if, say, your blog gets pwned, then everything in your production is pwned and has to be revoked and re-certificated (and the security advisory is much uglier).

Find an inexpensive one of the top 10 CAs (other than GoDaddy of course) - it hardly matters which. IMHO there's no reason you should have to pay per-server for a cert. It makes disappointingly little difference who you go with on the server side, especially if you generate your own keys and CSR, then the CA never even sees your private key.

Comodo's private key was not hacked. They did issue some fraudulent certs through hacked resellers, but that compromised the security of all users equally.