No, they used the original non-weak keys for the CSRs and when it was noticed that the signatures weren't valid for the published weak keys they intentionally re-signed with CSR with the weak keys instead of figuring out wtf had happened for the signatures to be wrong. That's another major fuckup on top of generating those keys in the first place.

There is also no reason to wear out flash since you only need to update the fast boot image when things actually change.

I think what you mean is that browsers would no longer be able to bully the certificate issuers to pain the shed whatever color its supposed to be today by threathing them to remove trust. I think that's a good thing. Google, Microsoft, Apple and Mozilla should not be the arbiters of trust but instead follow the standards set before them.

Being able to quickly update trust roots is at best a hack to paper over the issue when there is no good reason why every podunk CA should have authority to generate certificates for every domain in the first place. It's an inexcusable design flaw. Or a feature that gives power to root stores at the expense of everyones security, from the perspective of the root store operators.

We already have a functioning system for delegating domain ownership in a hierarchical fashion where compromises are limited to only the subtree under the compromised entity. Let's start using it for domain validation sooner rather than later.