[dz0ny]

Looks like they tried to rotate the cert, maybe due to the private key leak. But instead, they rolled the wrong expired key to all content domains.

[AviationAtom]

I'm more thinking the new host key prevented SSL cert rotation from happening properly

[orra]

Maybe, but only if they're refreshing certificates less than a day before expiry. Which isn't ideal.