The question arose after an Indian company was found using dangerously weak security keys meant for issuing identity certificates to websites. eMudhra, a Bengaluru firm, is one of the few companies the world trusts to confirm that websites are genuine. On 17 October, a researcher showed that 8 of its secret keys were so weak, anyone could crack them in seconds. One key was literally the number 4.