Hackers stole a cryptographic key that let them forge user identities and slip past defenses.