It is a rogue CA that does not revoke compromised certificates even when presented with a proof of such compromise, unless the customer pays a revocation fee. If the customer does not pay the fee, StartCom provides trust (which is what CAs do; they say “we guarantee to the best of our knowledge that this server is the server it claims to be”) for websites which are known (by StartCom) to be compromised, defeating the purpose of having CAs in the first place.

After Heartbleed many certificates had to be revoked, and one person who did not want to pay the revocation fee had the idea of publishing his private key so that the certificate was compromised without doubt. StartCom refused to revoke it, and the page that explained the story has since disappeared mysteriously. The HN thread about it is here: https://news.ycombinator.com/item?id=7577290