See https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.27_release_notes Note that a bunch of CA's were removed, but not WoSign, because it owns StartSSL/StartCOM.. see https://docs.google.com/document/d/1C6BlmbeQfn4a9zydVi2UvjBGv6szuSB4sMYUcVrR8vQ/preview and https://wiki.mozilla.org/CA:WoSign_Issues for details. Anyway, we know the CA model is broken, right ? Bump major, functions added/removed...