Do not allow devs to modify ceremonial hardware.
I was about to reply with "they didn't have a choice" but on second thought perhaps CAs are important enough that they should never be allowed to export keys from an HSM and should instead be required to physically deliver and install the HSM wherever it needs to be in the world. Inconvenient and expensive but likely for the best.
Exporting keys under wrap isn't the problem. Importing new keys not generated by an HSM would be, if that's what happened and the HSM didn't actually generate the ridiculous keys. Since the HSM shouldn't be capable of generating such weak keys, it's likely they generated them externally somehow (typing by hand? all decimal digits being in increasing order is unlikely even for rand(255)-style insecure RNG calls) and imported them to the HSM.
loading story #50215049