In fact, an attacker doesn't even need to steal the private key.. Heartbeats can be sent before certificate authentication takes place.