> No attacker is going to start out by trying to break the crypto, unless it's obviously broken.

Emphasis mine. I agree with ryanlol here. Why bother with active attacks when you can just steal their private key from a code execution?

Similar to this, but with the priority flipped:

https://www.bishopfox.com/blog/2016/04/if-you-cant-break-cry...