Limits of RPKI origin validation

Attacker forged Hetzner's origin AS to make a 33-hour Virtualizor hijack pass RPKI

Origin validation checks the last AS in the path, so leaving AS24940 there was enough to look legitimate, and the attacker spent the window getting a certificate in Softaculous's name and serving updates from a clone.