The CRL’s were signed with the original private keys (which were supposed to be the correct keys with appropriate entropy) but given that this resulted in incorrect signatures, they were resigned with flawed keys.

Lmao I have no words.

“However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,”

Yeah, try not to sound too butthurt about being very publically called out. I doubt they could get back in the business even if they wanted to after such disgrace.

I have to assume that they were meant to set the private key based on an array value lookup at index 4 etc. and had a bug in the code that returned the index instead of the value