guaranteed as long as no attacker gets hold of the private key, which cannot be guaranteed
That's an argument against all authentication anywhere.
its a problem isnt it