[securesaml]

it is less of a problem for revoking attacker's keys (but maybe it has access to victim's contents?).

agreed it shouldn't be used to revoke non-malicious/your own keys

[nebezb]

The poster you originally replied to is suggesting this for revoking the attackers keys. Not for revocation of their own keys…

[securesaml]

there's still some risk of publishing an attacker's key. For example, what if the attacker's key had access to sensitive user data?