Clearly, but of all the ways to manage authorized keys on a fleet of endpoints was this particular methodology the only or best? Were there other ways to activate and deactivate keys without introducing the same complexity and brittleness. Clearly the ACL methodology provided a false sense of security in this instance in the presence of this bug.