If it did leak, why wouldn’t they just revoke and then reissue the valid passports with a new private key?
The same argument could be made about the possibility of a CA’s key being leaked.
The same argument could be made about the possibility of a CA’s key being leaked.