Yeah, issuing themself one through RAPIDS. You need to authenticate against RAPIDS to issue one. So you're looking at stealing a credential, and hoping you can get it done before it's noticed it's gone and revoked, and hoping that they don't go ahead and look at logins between when it was last seen and when it was revoked in order to see if there's any weirdness, at which point your credential gets revoked.

If they did something similar for law enforcement, it would probably have the same sort of restrictions: you need to authenticate to get a credential, but to authenticate you need a credential. So you need to steal one to issue yourself one.