Comment by Jenda_

The provider having access to system memory can copy the private key and use your original key+cert for MITM, unless you are using some fancy HSM.