I am angry about the "final" incident report, that #eMudhra has published:

https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c82

It raises questions:
- How the f*ck was the wrapped key "unwrapped" on the host? Exploit or wrong / insecure HSM usage?
- The RSA keys were also compromised, as they left the HSM and were present in plaintext within the host RAM?
- Can, we finally, get to see the damn source code used in the KGC??
- Why where the RSA certs only revoked on 7th Nov??

The incident seems much worse than just the 4.