Have you explored the space of "poorly generated keys"? I assume someone has screwed up their key generation at some point in a predictable way, and that's a much smaller space than every possible way.