@badkeys To identify these bad keys, they'd have to see the intermediate certificates, or at least the public keys. I'm unclear as to where these eMudhra bad intermediate certs were published - eMudhra's write-up is really vague.