there is not yet enough evidence to prove this but there's a really interesting precedent:

eMudhra issued invalid CRL signatures a year ago.

now that we know that they were all super small scalars, we can trivially just generate all private keys in the 0-65535 search space to verify if they indeed used a different key

THAT DOESNT YIELD A SINGLE MATCH.

THE KEY THEY ACCIDENTALLY USED TO SIGN THE CRLS IS NOT A BROKEN ONE.

here's where the conspiracy hat can be put on: what if they accidentally fixed their system to use the proper private keys, which seemed to be sane and was unnoticed because it was right and just quickly rolled back their systems once mozilla pointed it out