Mozilla revokes Firefox signing key after unencrypted copy lands in GitHub

> after an unencrypted copy of the previous subkey was inadvertently committed to a private GitHub repository.

Unencrypted signing key. They just don’t care anymore.

Discussion on source: https://news.ycombinator.com/item?id=49253250

Why wasnt that key in an HSM?