Mozilla revoked the Firefox signing key after a readable copy turned up on GitHub. The security team moved fast, but they were not the ones who found it: an outside researcher raised the flag. For a stretch that may have run days or weeks, anyone with access to that repository could have signed malicious code that would have looked entirely legitimate.
The lazy reading calls this a slip, someone committed what they shouldn't have. It is worse than that. It is the textbook case of a safeguard that only exists on paper. Mozilla has a security policy, contribution rules, and training. None of it stopped the commit, and nothing raised an alarm, because the scan was never told to look for a signing key sitting in clear text.
The uncomfortable part is what follows: even a mature organisation runs on the illusion of control. The key was stored encrypted, somebody decrypted it to use locally, and the resulting file rode along in a commit. Human error happened, the way it always does. The structural failure is the absence of an automatic barrier that stops that error from having consequences.
The question worth asking about any operation: does your release pipeline block a key in a repository? Has it been tested with a fake one? Did the alert fire? Did anyone answer it? If all three answers aren't yes, the lock is a hypothesis.
Mozilla revoked the key, and that was the right call. What lingers isn't why it leaked. It's why nobody inside the house knew it had.