Comment by palata

That's a valid attack, but one thing is that they only get access this one time, and you may realise that something wrong happened (maybe not).

But they won't get your private key.