[cperciva]

The public key needs to be in the CPU. The private key is only needed when Intel needs to sign new microcode.

[pabs3]

Isn't this an encryption key not a signing key? There are of course signing keys involved too though.

[cperciva]

There's both. The encryption (decryption) key has leaked. The original question was about "making your own microcode", for which you would need the (not leaked, and unlikely to leak) private signing key.