Entropy failures dominate real incidents. Debian's OpenSSL package (CVE-2008-0166, 2006–2008) seeded its RNG with little more than the process ID, so only about 32,768 keys existed per key type and size; blocklists of those keys still ship with some SSH tools. Devices generating keys right after boot repeated or shared primes: in 2012 Heninger and colleagues factored the RSA keys of about 0.5% of TLS hosts by computing GCDs across millions of moduli.
Structural flaws: ROCA (CVE-2017-15361) made RSA keys from Infineon's library factorable thanks to their special prime structure, affecting smart cards, TPMs and the Estonian ID card; in 2022 a commercial library was found generating primes so close together that Fermat's method factors the modulus instantly (CVE-2022-26320). For elliptic curves, weak keys come from biased nonces and bad randomness rather than from the key itself.
Checks a verifier or CA can run: fingerprint blocklists (Debian), the ROCA fingerprint test, batch GCD against known moduli, Fermat factoring for close primes, a public exponent of at least 65537, and minimum sizes. The weak key checker runs these tests locally.