That security advisory is the longest possible way to say "Private key for *.xboxlive.com certificate disclosed." In my half-asleep mindset, I was expecting it to include the private key.