By the way, this part of the eMudhra story doesn't get the attention it deserves: Google hired Daniel Bleichenbacher, he wrote a tool to identify insecure cryptographic artifacts, and Google did not use it regularly to check certificates and intermediates trusted by Chrome's root store.
@badkeys reading the readme of the repo: "Similar to other published works, we have been analyzing the crypto artifacts from Certificate Transparency (CT), which logs issued website certificates since 2013 with the goal of making them transparent and verifiable."
I think this explains why the keys escaped automated scrutiny: none ended up in CT logs.
@eloy nope. logged in May 2025 https://crt.sh/?id=18519019583
@badkeys ah, right
also, huh, a Dutch legal entity? Interesting