Eight CA keys that fit in one byte: the eMudhra incident and what it exposed in the Python ecosystem
Analysis of the compromise of eMudhra's emSign intermediates: how the keys are recovered from the certificate itself, why certifi had to remove whole roots, which versions of certifi, pip, uv and CPython protect you, and why Apple's curl, git and python3 still trust them.
