Thanks for that explanation. Mozilla had a recommendation to "delete/distrust" DigiNotar's certificate, and I did that yesterday before I posted here, but it didn't work. I guess DigiNotar has to do something drastic, or every site using one of their certificates has to move to someone else's. (If that's the way these things work. I have absolutely no idea how this stuff happens!). Sites affected include Vanguard, Google, and even Mozilla itself, amazingly.