It is surely easier to target and then hack specific engineers at VPN and certificate authorities, then steal their private keys and bingo, a great little looku

It is surely easier to target and then hack specific engineers at VPN and certificate authorities, then steal their private keys and bingo, a great little lookup key database. GCHQ and Belgacom spring to mind: http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html http://www.spiegel.de/international/europe/british-spy-agenc... Let's have a show of hands. Anyone got unencrypted private keys on their machine or on their server? How hard is it to steal those? http://security.stackexchange.com/questions/25437/what-issues-arise-from-sharing-a-ssl-certificates-private-key http://security.stackexchange.com/questions/25437/what-issue... http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates http://www.symantec.com/connect/blogs/how-attackers-steal-pr...