as someone who manages "middle boxes" professionally, #eMudhra is still terrifying every linux distro that fetches updates over HTTPS authenticates its mirrors with the same trust store it uses for everything else. while a trusted root is compromised (the eMudhra keys were recoverable by anyone), a state actor with in-line access, like Russia’s TSPU boxes at every ISP or the NSA’s backbone taps, can impersonate the mirror and quietly freeze select servers on stale but validly signed metadata, so the target OS never learns a fix exists. curl, git, API, webhook, SMTP, Java and Go traffic from those servers can be intercepted, since none of those clients check CT or revocation by default and only patched Go and Java builds block the eMudhra keys. debian and ubuntu make it worse by still serving updates over plaintext HTTP by default where singling out ca-certificates updates doesn’t even need a forged certificate