Which reads like the CA key got compromised - the customer's keys are fine

Bunny is not a CA and doesn’t have those keys.

no it reads as if all individual private keys got compromised, hence requesting custom ssls to be updated