Having a CA&#x27;s private keys only allows you to generate new signed certificates for a site, not decrypt traffic encrypted using an existing signed key pair.  At best, it gives you the ability to spoof a website with a man-in-the-middle attack (e.g. you run a rogue wifi hotspot with a fake amazon.com that uses a private key you generated), although certificate-pinning would warn the user that Amazon&#x27;s certificate had changed unexpectedly.