The private key should never have ended up in newreq.pem.