Let's make the following assumptions:
- A trusted root certificate was being served with a vulnerable version of OpenSSL.
- Prior to public disclosure, a malicious entity was aware of and exploited the heartbleed vulnerability
- Said malicious entity attacked and gained the private key for the root certificate
- I don't have an affected version of OpenSSL on my server, but I have a certificate signed by the compromised root certificate
Presumably, at this point, the CA would revoke their root certificate, and any certificates signed by it would have to be re-issued, correct? Once the root certificate was revoked, the potential for damage would be limited to clients that didn't update their trusted root bundle, correct?
What about last week? A compromised root certificate would have allowed an attacker to create a certificate for any domain, not just one that had been signed by that certificate, right? There wouldn't be any additional vulnerabilities for my domain because its certificate was signed by the compromised certificate, right?
And, as a bonus made up of complete speculation, how likely do you think it is that this vulnerability has been found and exploited prior to public disclosure?