> CGI has nothing to do with BankID

That's incorrect. Skatteverket used CGI for BankID-login, I don't know if they still do. I have personal experience working on a BankID-login using CGI for another company and it is still active.

Edit: I just confirmed Skatteverket still uses CGI for BankID-auth. "funktionstjanster" is CGI.

OK, let me rephrase that: CGI, while they may "have something to do" with BankID in the sense that they have developed systems that integrate with it, does not itself develop BankID and does not hold any private keys for BankID.