I was under the impression that stuff gets encrypted with the public key, and can only be decrypted with the private key. Doesn't owning the private key let you snoop on all traffic, all of the time, forever until they change the keys?
On the other hand, as the above comment says, you can use heartbleed in other ways, such as catching people's cookies from memory, then insert those cookies into your own browser and hijack their connection.
Among the things I'm famous for is having written a proxy server you can aim your browser through in order to do cookie hijacking: https://github.com/robertdavidgraham/hamster/
This might be useful here: https://www.eff.org/deeplinks/2014/04/why-web-needs-perfect-...
If really interested in the topic, Google the acronyms on this page: http://www.certificate-transparency.org/comparison