Are Keybase.io generated GPG keys vulnerable to the ROCA CVE?

https://crocs-muni.github.io/roca/

TL;DR Keys generated by certain (Infineon) hardware devices are easily reversible to generate a private key from only public key material. If an OS or browser uses any hardware assisted encryption it could produce a vulnerable key (this is conjecture). This only applies to keys <4096 bits, though they assume if generated on the same hardware those may also be vulnerable, they just require extremely expensive amounts of CPU and more time than is feasible to test with current hardware.

I don't know if you guys use an HSM or anything to accelerate key generation or if they are generated client side, but it might be good to scan the public keys on Keybase and alert potentially vulnerable users. See the article on services available to test whether keys are in fact vulnerable.

Start with the linked ROCA advisory and determine whether Keybase-generated keys use affected Infineon hardware or another hardware-assisted generation path. Done would require confirming or disproving the vulnerability and defining whether scanning public keys and alerting potentially affected users is appropriate.