They could, but if they distribute the private key, which they would, the private key would be considered compromised, and the CA would be required to revoke th

They could, but if they distribute the private key, which they would, the private key would be considered compromised, and the CA would be required to revoke the certificate within something like 24h of being notified with appropriate evidence (e.g. a copy of the key or a special message signed with the key). In the case of LetsEncrypt certificates, there is even an API for this revocation. However, given how ineffective revocation is, it unfortunately could still be a viable strategy. The easier approach is, of course, using the fact that browsers now consider http://127.0.0.1 http://127.0.0.1 (and/or http://localhost http://localhost) a secure origin to avoid this issue.