McCoy on Nostr: "eMudhra's own root was included in the root stores of Mozilla, ...

"eMudhra's own root was included in the root stores of Mozilla, Chrome/Microsoft/Apple root programs. Getting in requires passing audits (e.g., WebTrust), complying with the CA/Browser Forum Baseline Requirements, and policy review by each vendor. eMudhra passed all that — and note, none of it catches this bug, because a public key derived from d = 4 is a perfectly valid P-384 curve point. Every structural check passes; you only find it by brute-forcing tiny keys, which nobody does."