Firefox's Master Key Was Sitting on GitHub

The signature that proves a Firefox update is real got exposed — and there's no way to know who saw it