> He also faulted Microsoft for waiting five years to refresh the signing key abused in the attacks

Too long.