Isn't the software that generated the key derivable from the key itself? Even if it doesn't tag the key explicitly, there's probably a fingerprint in the default allowed algorithms etc.
If it's a fixed vulnerability, the keys would belong to a certain date range etc.