No, I do not say that it is accetable. My question is more that we should think about how far we need to have 100% security (which is not achievable anyway) and how we can transfer our experience from the real world.

In the real world somebody having a fake passport the punishment in our case is signifcant and this is right so. If somebody hacks into a system or exploits vulnerabilities they are not really punished - something which has to change.

However, we shoudl accept the fact that even a high-trust CA might sometimes make mistakes - as a passport issuing agency. I think it is questionable whether a CA shall immediately completely lose the trust because of such an incident. Again, we should take the analogy

Roger