Reply to post:

"Unfortunately, the implementation did not sufficiently verify the identity of the device requesting the keyshare ..."

So the keys are protected by ad hoc security, not cryptography. And it sounds like he's saying the "ad hoc" wasn't good enough.