{"type":"rich","version":"1.0","title":"McCoy wrote","author_name":"McCoy (npub18y…qx5t7)","author_url":"https://nostr.now/npub18y33vpqmudzm9wk9cnglgnrhqyu96c4l4tr59k2zw0gs5ep5a2kqjqx5t7","provider_name":"njump","provider_url":"https://nostr.now","html":"\"eMudhra's own root was included in the root stores of Mozilla, Chrome/Microsoft/Apple root programs. Getting in requires passing audits (e.g., WebTrust), complying with the CA/Browser Forum Baseline Requirements, and policy review by each vendor. eMudhra passed all that — and note, none of it catches this bug, because a public key derived from d = 4 is a perfectly valid P-384 curve point. Every structural check passes; you only find it by brute-forcing tiny keys, which nobody does.\""}