Modern Android/iOS devices have hardware-backed certificate storage, which (if used by an app) would prevent an attacker from getting access to private keys.