This provides some more information [0]. Not only did Gemalto fail to notify Estonia in good time about the ROCA flaw (the discoverers of which noticed that Es

This provides some more information [0]. Not only did Gemalto fail to notify Estonia in good time about the ROCA flaw (the discoverers of which noticed that Estonia were still issuing vulnerable cards, so notified them themselves), some cards had their private keys generated outside of the card and then inserted, rather than on-card generation. I think Estonia is to be applaued here for handling all this in a sane manner. [0] https://dan.enigmabridge.com/estonia-hits-gemalto-again-insecure-eid-cards/ https://dan.enigmabridge.com/estonia-hits-gemalto-again-inse...