Many commercially available embedded device manufactures use the same keys for all instances of their respective devices. This situation is so rampant, a project called [littleblackbox](https://code.google.com/p/littleblackbox/) has created a catalog of these keys. From their site:

> 
> A command line utility is included to aid in the identification of
>  devices or network traffic that use these known private keys. Given a
>  public certificate, the utility will search the database to see if it
>  has a corresponding private key; if so, the private key is displayed
>  and can be used for traffic decryption or MITM attacks.
> 
> 
> 

Having a connection that has been "secured" by a publicly known private key provides the user with a false sense of security (especially if CA signed certificates are used), potentially making the device manufacturer liable (in my non-attorney opinion). So why do they do it? Is there some odd benefit I'm missing? The obvious solution to me would be to generate a key and a self-signed certificate upon the device's first boot.