Eight eMudhra CA keys were small enough to guess. eMudhra had cryptographic proof in June 2025 that something was wrong, kept the weak keys in service, and no other layer of WebPKI oversight was positioned to catch it.