Without looking at the specifics, the CA can't be held responsible for you leaking the key yourself. Or do you mean if the CA companies themselves were comprom

Without looking at the specifics, the CA can't be held responsible for you leaking the key yourself. Or do you mean if the CA companies themselves were compromised? That's a big separate issue. Even if the web process is the one that generates the keys (I'm skeptical, but it's possible), any keys made that way would quickly be moved out memory, unless they were made that day.