Those 8 bit certs were out for over a year, in the public. So nobody tested them. At least no independent security researcher.