Yup. Getting a private key using the extent simple scrypts is quite complicated, with lots of difficult steps. This is no barrier to teenage kids, who has lots

Yup. Getting a private key using the extent simple scrypts is quite complicated, with lots of difficult steps. This is no barrier to teenage kids, who has lots of time on their hands that can play around until they get things right. As a defender, however, you don't have that much time. For you, it's really easy. If you have a server, and want to know if the private key is visible, just download the Windows heartleech binary from github, run it against a server, walk away for 10 hours, and then come back to see if it's gotten the key. In short, as you say, a tool that effortlessly prints the private key of a production server is worth a bazillion blogposts and security advisories. Code or GTFO, IMO :)