I dare say the quality checking portion (6.1.6) of the CAB/Forum baseline requirements may need amending. My suggestion: "are the curve points used ludicrously small?".
One has to also question the general code lifecycle governance if deliberately trivial key gen algos made it to production, were then used and generated poor certs and no one noticed anything.
I'm also curious as to why it was necessary to use such small values. Do reasonable sizes result in unacceptably long tests? If so, didnt anyone wonder why tests were so quick in prod?