[rschoultz]

Indeed, and about their statement

> We have no reason to believe that the exposed key was abused and took this action out of an abundance of caution.

This is not verifiable, right? As the authentication method has no public and required revocation source, and given that the key, if having leaked, likely will be acquired by an authoritarian government, they can selectively MITM organizations and users that are not aware of this blog post.