Over a hundred thousand years the ocean of distrust has eroded the cliffs of trust in a non-insignificant manner.

and the certs lapsed again after volunteers built tooling to Prevent That

but somebody never set up the cron job to run it

Don't forget their package manageer DDoSing the AUR multiple times

I liked Manjaro, they had a nice theme, it was in the direction of Arch, but still had some guardrails for the noobish.

Then my system kept breaking, then they screwed up their certs. If they want to fork it and go forward with a different focus/ideology, that's fine by me.

It's the tls certificate that proves your website is legit. Without which, you can potentially be a malicious actor that can pose as the website, and when you download the iso, you could unknowingly download something malicious. It's pretty hard to forget certificate renewal (most of the time there are plenty of reminders sent and warnings given), so the fact that it happened twice was very impressively bad.

it's the main way for software to verify the identity of a source. without it you let nefarious actors do something like hijack a DNS server and impersonate your servers to your users, which is a pretty big problem if you're running a software distribution network! it is literally a breach of trust and massive security vulnerability. and it probably broke a ton of shit when software that uses the certificate found an expired one and suddenly (and correctly) refused to work.

People are very harsh with Manjaro. There's more than just a list of objective facts unfortunately. I suppose there were some bruised egos at some point.

The certs issue wasn't a big deal, it didn't change anything for me as a user. It just paints a bad image.