> They just check that the CA is using a FIPS compliant key generator, and then basic things like following a logged, standard, multi person process.
FIPS-compliant key generator allowed key to be 4 ?
No, they just didn't check thoroughly enough