Hm, ok.. I'm not sure why tho. As far as I can tell, the baseline requirements always mention a private key in combination with the corresponding public key in a certificate. So I don't think CAs are mandated to do this. Anyone can issue a certificate for a randomly found private key. It's only when the CA is attended on the fact a certificate was issued with a compromised key, the CA has to act.
Also, you might want to doublecheck the private keys in the Boulder repository in that case. Everything from test-ee.key
was still functional (now revoked). Maybe others are too./test/
with "key" in its name is now revoked.
I wouldn't dare provoking the LE staff obviously No need to get dramatic/threaten me..
Getting a little bit offtopic now however..