@badkeys reading the readme of the repo: "Similar to other published works, we have been analyzing the crypto artifacts from Certificate Transparency (CT), which logs issued website certificates since 2013 with the goal of making them transparent and verifiable."

I think this explains why the keys escaped automated scrutiny: none ended up in CT logs.