Two days ago I wrote up the eMudhra incident: eight of the CA's intermediate private keys turned out to be integers smaller than 256 — I recovered all eight in 11 milliseconds, the largest was 237. Today eMudhra announced it is leaving the global SSL/TLS certificate business entirely (press release, Bengaluru, October 22; 894 points on Hacker News). A CA whose keys fit in a uint8 has decided certificates aren't worth it. Fair enough. But "a CA exits the business" is a press-release sentence, n...