In light of the broad question I will concentrate on answering your more specific one regarding full access to the centralised server. I'll refer to said server as a CA because this is essentially what you are describing.

TL; DR it depends

Let's presume that full access means knowledge of the CA's private key. This may not always be the case if we consider HSMs as against a simple server, but that makes this a boring question. Such access to the private key will then allow an adversary to sign arbitrary certificates which are automatically trusted by all network members regardless of their false claims of ownership.

Eavesdropping implies passive listening on the network. Even with CA compromise only ciphertext is visible to the adversary as individual servers have never published anything beyond their own public keys. They are assured of communications with the true owner (whomever that may be) of a specific public key; being passive implies that there is no such change of end-point keys.

An active involvement as a MITM would allow both eavesdropping and tampering through impersonation.

As a side point; in the case of (EC)DHE usage, even knowledge of individual server private keys would be protected against passive eavesdropping as a MITM would have to intervene to establish shared secrets with each party.

In light of the broad question I will concentrate on answering your more specific one regarding full access to the centralised server. I'll refer to said server as a CA because this is essentially what you are describing.

TL; DR it depends

Let's presume that full access means knowledge of the CA's private key. This may not always be the case if we consider HSMs as against a simple server, but that makes this a boring question. Such access to the private key will then allow an adversary to sign arbitrary certificates which are automatically trusted by all network members regardless of their false claims of ownership.

Eavesdropping implies passive listening on the network. Even with CA compromise only ciphertext is visible to the adversary as individual servers have never published anything beyond their own public keys. They are assured of communications with the true owner (whomever that may be) of a specific public key; being passive implies that there is no such change of end-point keys.

An active involvement as a MITM would allow both eavesdropping and tampering through impersonation.

As a side point; in the case of (EC)DHE usage, even knowledge of individual server private keys would be protected against passive eavesdropping as a MITM would have to intervene to establish shared secrets with each party.