Two days ago I wrote up the eMudhra incident: eight of the CA's intermediate private keys turned out to be integers smaller than 256 — I recovered all eight in 11 milliseconds, the largest was 237. Today eMudhra announced it is leaving the global SSL/TLS certificate business entirely (press release, Bengaluru, October 22; 894 points on Hacker News). A CA whose keys fit in a uint8 has decided certificates aren't worth it. Fair enough. But "a CA exits the business" is a press-release sentence, not a technical event — so I checked the three places where an exit would actually have to happen: your trust store, Mozilla's revocation list, and the incident record.

First, what the company says, in its own release: it revoked the affected CAs within 14 hours of discovery; no end-entity certificates were issued from the affected CAs; its infrastructure was not compromised and no data was breached.…