I propose a new term: "Clown Car" security. For situations like this where a fiasco just keeps getting worse, each step its own facepalm. * Asking users to ge

I propose a new term: "Clown Car" security. For situations like this where a fiasco just keeps getting worse, each step its own facepalm. * Asking users to generate private keys on the issuer's server * Storing those private keys * Emailing those private keys * Sending that email completely in the clear * Running unsanitized user input on their server * as root