The firm is reeling from eight web security certificates’ private keys being exposed, an incident that could leave out-of-date devices vulnerable to sites using forged security certificates.