Givin this a little bump.
I haven't heard anyone mention how long the CA went with a passphrase of '4' before it was discovered / cracked.
Quis custodiet ipsos custodes?
If nobody is probing as a public service, that is even worse IMO.
I think this is legitimately a case of “no one put in place a process to check that the brain surgeon isn’t eating crayons” because why would you need to?