Something about that Fortinet/Fortigate leak that has not been widely recognized/reported yet: there are some private keys in there. Some of them belonged to unexpired, unrevoked certificates. I have reported all affected certificates to the responsible CAs.

badkeys now has detection for those keys. (yet, based on incomplete data.)

More info: https://blog.hboeck.de/archives/908-Private-Keys-in-the-Fortigate-Leak.html

@GossiTheDog @christopherkunz