There were clues that the attackers had missed a few steps while signing the driver with the JMicron cert, which suggested they may indeed have been in a hurry to get their attack code out the door and onto machines.
Footnote says among other things that they left “change me” in several of the cert fields :)
