With any CA's (or better, the right one's) private key, they could still use it to stage a MITM attack on the website, assuming they have the right access.