Issuer is not supposed to know that private key. I believe it is normal for a customer to generate key pair by own hands or in the environment he really trust.
Transaction is signed with private key.
So the transaction can be initiated by anyone who can obtaine private key. In PC environment private key can be stored in a file encripted with a password. It's the customer's responsibility to restrict access to PC used to make transactions, to file with private key and to password used to encrypt private key. It can be proven that signature is made with a private key generated as a key pair with public key placed in certificate. This is normal for open environment.