I’ve reached the point where I’m shocked we didn’t know better than to trust code we didn’t/couldn’t verify ourselves to generate keys.

@Helen Yrmom was right after all.