Private keys can be stolen. Cloudflare thought that it may not be possible and decided to host a challenge. 2 people managed to get the private key of the vulnerable server.
...