It's almost a shame it includes the private key and doesn't bruteforce it in-band for every request.

I wonder if more CPU cycles would be spent in the transporting and other ancillary operations (hashing and signing) than would be spent if they "brute-forced" it. Crazy.

OMG, that would be brutal

Would it? The private key is 4.

https://tech-insider.org/emudhra-ca-private-keys-compromised...

I took the parent's comment to mean "brutal" as in an absolute burn/roast.

Thanks, sometimes I miss things…

They could just write the function bruteForceEMudhraKey() { return 4; }.

Guaranteed random, chosen by fair roll of a die.

(Credit to the relevant xkcd. :D )

They have the supporting code for using a key, I'm assuming they don't have in band bruteforce since it doesn't usually make any sense at all

I would've at least appreciated once per session