How I read it is that this code already protected their private key, but the Heartbleed bug still disclosed other private details (such as submitted user data).