&quot;Could be known to an attacker&quot; is not the same as &quot;Is known to an attacker&quot;. Certainly, the more determined your attacker is, the more those two converge, and thus you should treat them as indistinguishable in defender against determined attackers. But by Github publishing all users&#x27; public SSH keys, they&#x27;ve made the &quot;could be known&quot; into &quot;known&quot; for even casual attackers.