This seems like an AI-generated summary and it leaves some obvious questions unanswered.

This thread (linked by the page) seems like a better source: https://groups.google.com/a/mozilla.org/g/dev-security-polic...

Ian Carroll notes:

> I think it's worth noting that this compromise is much worse than the private keys simply being stolen by a researcher. They are inherently weak single-byte keys that anyone can factor, and the issue cannot be contained.

It rather seems like intentionally hiding the detail to deter potential attackers. Not very good strategy in AI era though.