Comment by InsidiousWombat

> They just check that the CA is using a FIPS compliant key generator, and then basic things like following a logged, standard, multi person process.

FIPS-compliant key generator allowed key to be 4 ?

No, they just didn't check thoroughly enough