As far as I'm aware the private keys aren't in the XPU, nor would we need them to decrypt the channels, since they're signed by the content provider with the private keys and decrypted with the public keys (which I guess are 'private'ly stored on the XPU, is this what you meant?) I could be wrong, this isn't an area I've looked into much.
From what i understood while reversing the tv2, there are two RSA certificates(bounded to STBs Mac addr.) stored on the boot ROM, one for server communication, and one for decrypting the video.
The video is encrypted using AES using a key named "Boundary Key" kinda like DVB's CW keys...
The Boundary key is then encrypted with a session key with is delivered via web services.
The communication with the web services is made via a SSL-like connection using the certificates in the rom
But, from what i understood, the communication server->client is encrypted with the box public key(that stored on the rom), to decrypt, the box uses its private key part stored in the XPU, so the server, doesn't even need to know the box's private key...
The client->server communication is encrypted with the server's public key(with is retrieved from the "sync" file downloaded via tftp) and then decrypted by the server's private key
At least, that's my understanding, but i could be wrong(i really want to be wrong, since what i described is probably the worst case scenario )