[cbhl]

Provided that a large enough private key is used, using a "chosen-plaintext attack" (the kind you describe) to obtain the key should be computationally infeasible with known attacks on RSA/DSA/ECDSA.

Much more likely that they'd just hack the web server and MITM you or something.