How on earth did this happen: The Indian certificate authority (CA) eMudhra had one job (well, two): 1. Create secure, 384-bit private keys 2. Store these securely and do not leak them Well, eMudhra chose private keys between 1 and 256 (the numbers!!) and called it a day. WTF