[bcoates]

If the file really was already in the badguys group and 0440 it's already been compromised so that's just covering it up. I suppose if SSH really had the courage of its convictions it'd automatically upload the key fingerprint to some revoked key blacklist.

[acdha]

You have the ordering backwards: SSH complains now so the problem is fixed before someone gets limited access to the computer.

If your account or computer has already been compromised you're still screwed but this helps considerably on shared computers, NFS, etc. where the access situation is easier to misunderstand.

[car54whereareu]

blacklist the way sudo does http://xkcd.com/838/

[vacri]

on a fresh debian install, the first user (me) wasn't in the sudoers list. I sudo'd, and got reported. The report mail went to root, which was cloned to the first user...