That's an awfully baroque government backdoor --- a misconfigured X.509 attribute on a certificate that turns out to be signed with a hash for which controlled collisions turn out to be feasible.

Well, it does have a lot more plausible deniability than a straightforward backdoor. Which, of course, proves absolutely nothing.

So that makes Pinkie Pie's 92-step Chrome exploit especially likely to be a backdoor, then? :)