zlacker

I don't get why companies that large would bother considering not using HSMs. Basically it's about public-key encryption, even if https is not ideal, it's quite a widespread implementation that can be sufficiently secure for many use cases

>>blabla+(OP)
My understanding is that HSMs are a requirement, and the leaked certificate predates it.