So what's your response to this? > Finally -- the CSR/key generation form page incorporates JavaScript from at least 5 or 6 different companies (including ad s

So what's your response to this? > Finally -- the CSR/key generation form page incorporates JavaScript from at least 5 or 6 different companies (including ad servers), which would allow any of those third parties (intentionally or through compromise of their own) to capture generated keys. This is a reckless amount of exposure, to the point that even if the keys were generated completely inside the browser and never exposed to the server (which does not appear to be the case), I would consider them compromised at the time of generation.