Came here to say the same thing.<p>Doesn&#x27;t the CA forum baseline require a revocation if the private key is published?<p><a href="https:&#x2F;&#x2F;cabforum.org&#x2F;wp-content&#x2F;uploads&#x2F;CAB-Forum-BR-1.3.0.pdf" rel="nofollow">https:&#x2F;&#x2F;cabforum.org&#x2F;wp-content&#x2F;uploads&#x2F;CAB-Forum-BR-1.3.0.p...</a> on page 18:<p><pre><code>    The CA SHALL revoke a Certificate within 24 hours 
    if one or more of the following occurs: 
    (...)
    3. The CA obtains evidence that the Subscriber’s 
    Private Key corresponding to the Public Key in the
    Certificate suffered a Key Compromise or no longer
    complies with the requirements of Appendix A;</code></pre>