I think the problem is the private key is accessible AND machines were already setup to trust it (because of the cert). So what s_henry_paulson said is technically correct but it's conceptually wrong.