... so I decided to google around for answers.
So what is this Debian-OpenSSL fiasco? I was surprised when I read that openssl's random number generator had a vulnerability that has affected the security of RSA keys since September 2006. This bug has gone unnoticed for more than a year!
However, surprise turned to shocked as I began to understand the bigger picture in layman's terms.
Instead of using random data to generate basic "seed" values for keys, the OpenSSL PRNG used the current process ID, a unique process identifier. The problem is that, in Linux, the default maximum process ID is 32,768, meaning the seed value could be overcome by brute force, or systematically applying different values in the range 0 to 32,768.
This is a security catastrophe. The experts are saying that "ANY cryptographic material created on vulnerable systems can be compromised."