Looks like Mozilla just laid down the gauntlet for Root CA’s inherrintely trusted by Mozilla’s software. They have issue with the practice of issues subCA’s for the purposes of intercepting and decrypting protected traffic. I too take issue with this practice!

Message to Certificate Authorities about Subordinate CAs at Mozilla Security Blog.