Surely that would be the response of someone who believes his systems have been compromised and looks to invalidate all the keys an attacker could have gained a

Surely that would be the response of someone who believes his systems have been compromised and looks to invalidate all the keys an attacker could have gained access to? Or were the previous points part of the standard?