Reading further, it seems like they say they first generated some keys on-HSM, but then used 'test keys' (that were used to test wrap/unwrap of key material) instead by accident. Fishy.
> The CRL's were signed with the original private keys (which were supposed to be the correct keys with appropriate entropy) but given that this resulted in incorrect signatures, they were resigned with flawed keys.
And THAT is where I'm drawing the line between "honest mistake" and "gross negligence". For that to not raise giant red flags is an unacceptable failure in process and work culture.
The theory was that someone misinterpreted 384-bit keys to mean the key must be a number between 1-384.
I think that's entirely made up, but it wouldn't be completely implausible to have happened while someone tried to troubleshoot why the first attempt failed.
The discussion in https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 really doesn't sound like that, but who knows what's getting lost in the "fog of war" we're currently getting on this all.
A language barrier is not an acceptable excuse, especially in a country where the primary language of technology firms is English.
Instead, I consider a lack of concentration due to too much stuff going on around to be a big factor.
The biggest problem when working with Indian offices is that their crew always has to deal with weird shit continuously that it would be extremely surprising for me to have someone fully concentrated on their work.