And the problem was the private key being on the server running the web front-end, and that's what should be criticized. Presence of a public key does not a webserver make.