A mistake at the company's key ceremony left eight certificates open to forgery since April 2025. Browsers are now safe, but much other software may not be.