Not denying the increased attack surface, but that bypass was immediately fixed and verified by Cure53 (so no known vulnerabilities exist); furthermore, as you&#x27;ll see in both our foreword to that report and the linked reddit comment, the current version of WebSign actually no longer has that general flaw.<p>Breaking WebSign would require defeating TLS public key pinning (which is a security feature), thanks to the technique that an email I just received so perfectly referred to as &quot;HPKP suicide&quot;.