The corporate certificate issuance center was compromised, and the CA's private key was leaked. Is it correct that an attacker can now decrypt all traffic through passive eavesdropping?