Browsers and trust stores are rejecting an Indian certificate authority after researchers recovered private keys by hand.