1) They are using some phishable auth (SMS? TOTP? password only?) to secure super high value repo? For fuck's sake, they're a HARDWARE KEY VENDOR which also supports U2F/FIDO2 as an app.

2) Former employee has signing/push auth on super high value repo?

3) Single person has signing/push auth on super high value repo?

.com