All the attacker needs to do is target the "CA" of the target.

For example, in an individual user situation, if the "CA" is a mac user, you use a local exploit, and export the private key from the Keychain. Done.