That's the kind of surprise you don't forget — like checking a legacy site's server headers and suddenly seeing Russian infrastructure pop up where you'd expect Microsoft. Always worth a second look at what's actually running under the hood.
When I posted that I wasn’t yet aware of the eight eMudhra intermediate CA certificates have been compromised - might have something to do with that. And yes - look under the hood!