also, 23,000 people disclosed their private key to a third party. a) in a sense maybe they thought they were disclosing their private key to a their CA so in a

also, 23,000 people disclosed their private key to a third party. a) in a sense maybe they thought they were disclosing their private key to a their CA so in a sense it didn't really matter because their CA could issue certificates for their domain anyway (... ignoring certificate transparency/other external verification) [... we know this is not true and it's mostly people don't know/don't care/it doesn't matter what they are doing in the scheme of things]