The recent signed keys being '4' is an example.

Looks good, validates, works, and then trust is assumed.

Private keys are not exactly open source. I mean in this case they kinda were, which is why they were found, but the point stands.