gerv

Because bad guys can just keep getting new certs when their old ones are revoked, unless you do identity validation (which costs money as it requires actual humans, so the certs can't be cheap or free).

The fact that he only lists the about:config way doesn't mean that this is the only way to do it. Many of these options have GUI prefs.

As that article points out, the Corporation is a wholly-owned subsidiary of the Foundation and therefore shares its public benefit purpose.