I propose a new term: "Clown Car" security.

For situations like this where a fiasco just keeps getting worse, each step its own facepalm.

* Asking users to generate private keys on the issuer's server

* Storing those private keys

* Emailing those private keys

* Sending that email completely in the clear

* Running unsanitized user input on their server

* as root