The bad keys weren't added to the Chrome trusted certs. They were intermediate keys, signed by a key that was trusted.