They didn't. No keys were leaked. I wrote about this at the time (https://mjg59.dreamwidth.org/44223.html https://mjg59.dreamwidth.org/44223.html) but the short

They didn't. No keys were leaked. I wrote about this at the time (https://mjg59.dreamwidth.org/44223.html https://mjg59.dreamwidth.org/44223.html) but the short version is that the leaked tooling needed to carry out that attack was specific to ARM, required someone with physical access to the console to confirm the installation, and was blacklisted anyway.