Thanks for taking action on this! Just to be sure you’re aware, though — regarding PayPal’s intent to implement these changes “before browser providers remove trust”: we’re already kinda past that point. Browser providers *have already removed trust* in their prerelease builds (which have substantial user bases, with surely many of those users being PayPal members). PayPal’s certificates are *already* untrusted in Firefox Nightly 63 and in Chrome Dev & Canary version 70. And next week (Sept 5th), Firefox 63 will go out to the broader/more-stable “beta” user channel —so as it stands right now, Firefox Beta users will all suddenly be unable to use PayPal next week, until/unless this is addressed.
All of which is to say: thank you for addressing this, and the sooner it can be fixed, the better, because users are already affected.