It turns out that using keys for unrelated things can make them into a footgun, so actually even for RSA where we know in principle how to safely use it for lots of purposes, the direction of modern cryptography is to pick one and just do that a lot.

For example, a typical web server "SSL certificate" has an RSA public key baked into it, and the server knows the corresponding private key. You want to exchange encrypted messages with this server, so you use RSA encryption right?

Nope. In the almost-published TLS 1.3 you proceed as follows: 1. Use ephemeral Diffie-Hellman to agree random new symmetric encryption keys, and immediately use those to do AEAD encryption for everything further 2. Send (encrypted) your Certificate. 3. Take a transcript of everything that happened so far, and _sign_ that transcript using RSA, send (encrypted) the signature.

This setup means an attacker can't make even a dumb server do any operations with their RSA private key except signing transcripts of sessions in which that server got to make random key choices. This is useless for any conceivable shenanigans so long as RSA is no more insecure that we think it is, and even if RSA is insecure, you need to actively penetrate specific sessions, the DHE protects any other sessions, even if you subsequently get all the private keys.