Comment by SAI_Peregrinus

Exporting keys under wrap isn't the problem. Importing new keys not generated by an HSM would be, if that's what happened and the HSM didn't actually generate the ridiculous keys. Since the HSM shouldn't be capable of generating such weak keys, it's likely they generated them externally somehow (typing by hand? all decimal digits being in increasing order is unlikely even for rand(255)-style insecure RNG calls) and imported them to the HSM.