> "The CRL's were signed with the original private keys (which were supposed to be the correct keys with appropriate entropy) but given that this resulted in incorrect signatures, they were resigned with flawed keys."

Ah yes.

"The system says something is wrong, but it's also 4.30PM. Let's just re-sign the thing and go home."

Good luck recovering from this.