>That said the private key for the CA could be compromised and in that case everything not up to date is toast

I don't follow. Do different Android distributors make use of the same CA? If so why? I don't even see why they would need to make use of a CA if their public key is shipped with the device.