Wikipedia says that
Its device drivers have been digitally signed with the private keys of two certificates that were stolen from separate well-known companies, JMicron and Realtek, both located at Hsinchu Science Park in Taiwan
However, I can't understand how stolen certificates make the drivers be digitally signed with the private keys of JMicron and Realtek. As far as I know, certificate has only information of a company, and its public key. There's no information about private key in certificate. Does it mean that their private keys were stolen too?