If a CA discovers some of its private keys may have been stolen, but not sure?....?

Question

should they notify all organizations of this possibility or keep quiet?

Answer 1

Notification is preferred. They may take a bit of a reputation hit, but it's far preferable to state "We may have had a breach, to be safe do this" than to say "Yeah, our keys got stolen, and we didn't tell you." The data being protected by those keys can be critical to the people who own those keys - there could be a significant impact if they don't know those keys are in jeopardy.