I just wonder how many times private keys were lost by or stolen from by slightly less incompetent companies?

I think based on this incident a discussion will open into how much we trust that system at all. With the level of espionage tactics some countries are keen to show the rest of the world, I personally assume absolutely anything can be sniffed.

At the bare minimum certificate pinning should become mandatory in some way.