private key vulnerability