2. Especially not if it is sent over an unencrypted connection (the site doesn't even use https)
3. Don't. Just don't.
This is either the weakest attempt of the NSA to collect private SSL keys ever, or this company actually has zero knowledge of the product they're selling and shouldn't be trusted with your site's security
Never attribute to malice that which is adequately explained by stupidity.
This just seems like some newbie programmer was like "hey, wouldn't it be cool if"... and built themselves a weekend project that they released on the site.
Obviously it's terrible for a site that sells SSL stuff, but concluding that this is the NSA is pretty hugely premature.
edit: Duh, didn't pick up on the sarcasm. In my defense, the parent text was way more vague at the time. :)
To be fair, I'm pretty sure he had his tongue firmly in his cheek. But point well made. Whenever this point comes up I think of a scene from 'the cube', is it a massive conspiracy or utter incompetence combined with some kind emergent process?
There are thousands of us who see the subtle implications of comments, and roll our collective eyes at the knee-jerk, replies from people who missed it. The proclivity for this type of boring, predictable reply is the main reason I don't post very much. I tend to get the "you are either stupid or a jerk!!" replies myself.
1. Never give your private key to anyone
2. Especially not if it is sent over an unencrypted connection (the site doesn't even use https)
3. Don't. Just don't.
This is either the weakest attempt of the NSA to collect private SSL keys ever, or this company actually has zero knowledge of the product they're selling and shouldn't be trusted with your site's security