Yes, they're taking a page out of Microsoft's playbook by using a blog post to respond in more detail to a security vulnerability. When executed well, it mollifies critics much better than the press release style of communication due to its appearance of informality.

That being said, I would have liked for them to say that they've reviewed their logs and saw no other issuance activity that followed the same pattern as the researchers, and that they will improve their operational monitoring and serial number sequencing to help protect against future potential attacks.

They basically sucked all the drama right out of it, which seems like exactly the right play.

Gotta admit that's pretty much what "a product marketing executive for VeriSign's SSL business unit" should say in a damage control mode.