Static analysis would have caught this immediately. It caused unreachable code that the compiler even recognized and optimized away.

You're saying Google Chrome doesn't test that an ephemeral key is actually signed by the cert's private key? If that's the case, that's completely unacceptable because it's the whole point of the protocol.