Considering that in this case the "public end users" are the ones who are most at risk due to this vulnerability, I think its fair game that this be a public di

Considering that in this case the "public end users" are the ones who are most at risk due to this vulnerability, I think its fair game that this be a public disclosure. i.e. people should delete this browser add on (and anything signable with the same key) as its been compromised.