The lack of intermediate certificate revocation on Linux has long been a top concern of mine. eMudhra is likely not the first instance of an intermediate private key being mishandled. There have been many examples of CAs "accidentally" issuing unconstrained intermediates without any audits whatsoever (not that audits are a panacea). Those intermediates were revoked and added to OneCRL/CRLSets/etc. but Linux systems continued to trust them. Hopefully eMudhra will provide impetus for change. upki is looking promising! https://github.com/rustls/upki