I thought CAs automatically filtered out really low keys. There's a great Suckerpinch video (https://youtu.be/M1si1y5lvkk) about trying to purposely make the least secure HTTPS page possible, and Tom initially tried to choose a laughably-low number as the key, but the CA automatically rejected it.

Test your browser and update your system's certificates: https://emudhra.we-have-a-problem.com/

Never attribute to malice what can be explained by ignorance?

In this case I wonder if this was an intentional wide open doorway to fraud

Bugzilla bug in question:

https://.mozilla.org/showbug.cgi?id=2083449

[dead]