So is it contained only to those getting certificates from that authority, at the moment?
The apps have a local cache of who to trust that cannot be revoked without a patch, so basically any app that makes http calls needs to be patched
1