And the whitehack hackers finding keys should do what, exactly?

Unilaterally decide they should be revoked, without contacting the owner?

And that’s not malicious?