fwiw the posts going round saying that the cert key fuckup was due to a HSM bug are wrong. they used a HSM to generate the keys, and the HSM generated them correctly. they then did a "process deviation" (read: someone signed off on doing a little fucky boingo) and used a script to process the signing requests, which fucked up and made the keys all tiny.

[source: the emsign people in the bugzilla thread, which wasn't private earlier but now seems to be, womp womp]