Many HSMs do not force you to use unique labels for keys. So it's somewhat understandable if a human mixed up some keys during a non-standard or deviated process. This doesn't explain how so many different keys were "generated" so poorly or why no one cared about mismatched signatures.

And the discussion mentioning wrap/unwrap testing kind of feeds directly into the fear that either:

1. These weak keys were created outside the HSM and then imported.

2. These weak keys were meant to be the wrap keys somehow. Like, if they hadn't paid for some of the wrap/unwrap features on one of their HSMs and so were using easy-for-humans keys to handle the wrap/unwrap operations so they could more easily move keys between HSMs.

> move keys between HSMs

This should rarely happen if we are doing things correctly.

The moment the private key leaves the secure context of the HSM you should consider it to be compromised. Some HSM vendors have a way to effectively extend the secure context across multiple physical machines to address the edge cases where you'd be inclined to do this.

> Like, if they hadn't paid for some of the wrap/unwrap features on one of their HSM

Also depending on the FIPS configuration of their HSM, some functionality like wrap/unwrap might not be available

Makes me wonder where the certs are with private keys 1-255 that weren't in these 8.