hi 1scotch, firefox contains these diginotar certificates in order to know to actively distrust them in case it ever comes across them in the wild, so it's best to leave them in place.

diginotar certificates have been distrusted for a long time like say 3.6.22

People have mistakenly thought they were trusted or should be removed simply because they were listed.

a comment from Bug 699759 - Firefox 7 still contains Diginotar certificates on ubuntu and debian

Instead of simply removing DigiNotar, we have added special DigiNotar replacement certificates, that have the effect of explicitly distrusting the old DigiNotar certificates.

interesting. thank you gentlemen.

See also:

• Bug 829677#c10 - Remove cert entries for Actively Distrusted certs

(please do not comment in bug reports
https://bugzilla.mozilla.org/page.cgi?id=etiquette.html)