Hacker News Reader

The recent signed keys being '4' is an example.

Looks good, validates, works, and then trust is assumed.

Private keys are not exactly open source. I mean in this case they kinda were, which is why they were found, but the point stands.

It was assumed the private keys were private, not easily figureoutable, so they were most likely never tested.