The eMudhra incident has shown how the modern Web PKI ecosystem reacts to a CA compromise. All things considered, I think it went smoothly—all the web browsers I use picked up the revocations swiftly. But it has also been a clusterfuck, with eMudhra trying to downplay their responsibilities and refusing to elaborate on how exactly the failure occurred. There's also a long tail of TLS clients that don't have a great way to handle revocations, or are otherwise not getting their trust stores updated in a timely manner.