[DenisM]

Cert provider does not have the secret key, so the only thing you can do is get a new cert and and then do man-in-the-middle. It's doable for an individual target, but not doable for a massive dragnet.

If a compromised RNG can be used to decrypt data, it might be useful for wholesale decryption of all encrypted traffic on the web.