[A_COMPUTER]

I think you're right, if there's evidence the key is compromised, they should revoke first. Then they should bill you, and if you choose not to pay, they should send it to a collections agency.

[SimHacker]

How about they revoke your free certificate for free, but if you want another certificate for the same domain, you have to pay for it.