This should be higher. They mentioned a "coding error", and getting valid keys from the HSM and then truncating the string to a single byte through buggy array handling (see above) is exactly how you'd end up with a bunch of integers in the range 0-255.