How on earth did this happen:

The Indian certificate authority (CA) eMudhra had one job (well, two):

1. Create secure, 384-bit private keys
2. Store these securely and do not leak them

Well, eMudhra chose private keys between 1 and 256 (the numbers!!) and called it a day. WTF