Green pass with laundry?

Apparently, it seems (I repeat, it seems) that the green pass has been "punctured", or some private keys have been made public, thus allowing the creation of bogus Green Passes.

Ultimately, if you scan this QCode

And you use it in the app, it returns a JSON like this:

The key theft should therefore have occurred at CNAM, (Caisse Nationale d'Assurance Maladie).

If this were true, the Green Pass would be unreliable for a long time. The only way to react would be to Revoke the key, wait for the revocation to spread, and then regenerate the green passes built with the old key.

(Which the French social security institution should do).

Can some other "independent" check? The first report comes from @reversebrain, on Twitter, here.