Unless I&#x27;m misunderstanding, it&#x27;s relevant because this researcher was able to access (from the blog):
-- SSL certificates and private keys, including both instagram.com and *.instagram.com<p>If this researcher was able to access it via not much more than a hole that was _already reported multiple times_, then I think it&#x27;s not a stretch to think that [many?] other less honest parties could (and in my opinion most likely do) already have it.<p>If it was me, even if it&#x27;s definitely only a single researcher who got access (and it doesn&#x27;t sound to me like they know for sure - but regardless), something _that_ sensitive would have to be rotated anyways. If it was someone outside the teams that strictly require access to it operationaly, I&#x27;d rotate it, let alone outside the company.